diff --git a/.ci-mgmt.yaml b/.ci-mgmt.yaml
new file mode 100644
index 00000000..d2eecaff
--- /dev/null
+++ b/.ci-mgmt.yaml
@@ -0,0 +1,35 @@
+template: external-bridged-provider
+provider: talos
+organization: pulumiverse
+major-version: 0
+providerDefaultBranch: main
+upstreamProviderOrg: siderolabs
+publishRegistry: false
+enableAutoRelease: false
+plugins:
+  - name: terraform
+    version: "1.0.19"
+    kind: converter
+  # - name: random
+  #   version: "4.16.7"
+  # - name: aws
+  #   version: "6.56.1"
+  # - name: local
+  #   version: "0.1.5"
+  # - name: "null"
+  #   version: "0.0.8"
+languages:
+  - dotnet
+  - go
+  - nodejs
+  - python
+publish:
+  sdk: "all,!java"
+  cdn: false
+#license:
+#  ignore:
+    # Don't check for the license of the local shim package
+    #- github.com/scaleway/terraform-provider-scaleway/v2/shim
+toolVersions:
+  go: "1.22.x"
+pulumiConvert: 1
diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
new file mode 100644
index 00000000..7d46cd80
--- /dev/null
+++ b/.devcontainer/Dockerfile
@@ -0,0 +1,12 @@
+FROM jetpackio/devbox:latest
+
+# Installing your devbox project
+WORKDIR /code
+COPY devbox.json devbox.json
+COPY devbox.lock devbox.lock
+RUN sudo chown -R "${DEVBOX_USER}:${DEVBOX_USER}" /code
+
+
+RUN devbox run -- echo "Installed Packages."
+
+RUN devbox shellenv --init-hook >> ~/.profile
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
new file mode 100644
index 00000000..e7ae9f11
--- /dev/null
+++ b/.devcontainer/devcontainer.json
@@ -0,0 +1,16 @@
+{
+  "name": "Devbox Remote Container",
+  "build": {
+    "dockerfile": "./Dockerfile",
+    "context": ".."
+  },
+  "customizations": {
+    "vscode": {
+      "settings": {},
+      "extensions": [
+        "jetpack-io.devbox"
+      ]
+    }
+  },
+  "remoteUser": "devbox"
+}
\ No newline at end of file
diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 00000000..ff9aa4f9
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+sdk/**/* linguist-generated=true
diff --git a/.github/actions/download-bin/action.yml b/.github/actions/download-bin/action.yml
new file mode 100644
index 00000000..edc3f6a5
--- /dev/null
+++ b/.github/actions/download-bin/action.yml
@@ -0,0 +1,16 @@
+name: Download binary assets
+description: Downloads the provider and tfgen binaries to `bin/`.
+
+runs:
+  using: "composite"
+  steps:
+    - name: Download provider + tfgen binaries
+      uses: actions/download-artifact@v4
+      with:
+        name: talos-provider.tar.gz
+        path: ${{ github.workspace }}/bin
+    - name: Untar provider binaries
+      shell: bash
+      run: |
+        tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{ github.workspace}}/bin
+        find ${{ github.workspace }} -name "pulumi-*-talos" -print -exec chmod +x {} \;
diff --git a/.github/actions/download-sdk/action.yml b/.github/actions/download-sdk/action.yml
new file mode 100644
index 00000000..1fd54841
--- /dev/null
+++ b/.github/actions/download-sdk/action.yml
@@ -0,0 +1,19 @@
+name: Download SDK asset
+description: Restores the SDK asset for a language.
+
+inputs:
+  language:
+    required: true
+    description: One of nodejs, python, dotnet, go, java
+
+runs:
+  using: "composite"
+  steps:
+    - name: Download ${{ inputs.language }} SDK
+      uses: actions/download-artifact@v4
+      with:
+        name: ${{ inputs.language }}-sdk.tar.gz
+        path: ${{ github.workspace}}/sdk/
+    - name: Uncompress SDK folder
+      shell: bash
+      run: tar -zxf ${{ github.workspace }}/sdk/${{ inputs.language }}.tar.gz -C ${{ github.workspace }}/sdk/${{ inputs.language }}
diff --git a/.github/actions/setup-tools/action.yml b/.github/actions/setup-tools/action.yml
new file mode 100644
index 00000000..4e302190
--- /dev/null
+++ b/.github/actions/setup-tools/action.yml
@@ -0,0 +1,81 @@
+name: Setup tools
+description: Installs Go, Pulumi, pulumictl, schema-tools, Node.JS, Python, dotnet and Java.
+
+inputs:
+  tools:
+    description: |
+      Comma separated list of tools to install. The default of "all" installs all tools. Available tools are:
+        go
+        pulumicli
+        pulumictl
+        schema-tools
+        nodejs
+        python
+        dotnet
+        java
+    default: all
+
+runs:
+  using: "composite"
+  steps:
+    - name: Install Go
+      if: inputs.tools == 'all' || contains(inputs.tools, 'go')
+      uses: actions/setup-go@v5
+      with:
+        go-version: "1.22.x"
+        cache-dependency-path: |
+          provider/*.sum
+          upstream/*.sum
+          sdk/*.sum
+
+    - name: Install pulumictl
+      if: inputs.tools == 'all' || contains(inputs.tools, 'pulumictl')
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        tag: v0.0.46
+        repo: pulumi/pulumictl
+
+    - name: Install Pulumi CLI
+      if: inputs.tools == 'all' || contains(inputs.tools, 'pulumicli')
+      uses: pulumi/actions@v5
+      with:
+        pulumi-version: "dev"
+
+    - name: Install Schema Tools
+      if: inputs.tools == 'all' || contains(inputs.tools, 'schema-tools')
+      uses: jaxxstorm/action-install-gh-release@v1.11.0
+      with:
+        repo: pulumi/schema-tools
+
+    - name: Setup Node
+      if: inputs.tools == 'all' || contains(inputs.tools, 'nodejs')
+      uses: actions/setup-node@v4
+      with:
+        node-version: 20.x
+        registry-url: https://registry.npmjs.org
+
+    - name: Setup DotNet
+      if: inputs.tools == 'all' || contains(inputs.tools, 'dotnet')
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: 6.0.x
+
+    - name: Setup Python
+      if: inputs.tools == 'all' || contains(inputs.tools, 'python')
+      uses: actions/setup-python@v5
+      with:
+        python-version: 3.11.8
+
+    - name: Setup Java
+      if: inputs.tools == 'all' || contains(inputs.tools, 'java')
+      uses: actions/setup-java@v4
+      with:
+        cache: gradle
+        distribution: temurin
+        java-version: 11
+
+    - name: Setup Gradle
+      if: inputs.tools == 'all' || contains(inputs.tools, 'java')
+      uses: gradle/gradle-build-action@v3
+      with:
+        gradle-version: 7.6
diff --git a/.github/actions/upload-bin/action.yml b/.github/actions/upload-bin/action.yml
new file mode 100644
index 00000000..bea39d30
--- /dev/null
+++ b/.github/actions/upload-bin/action.yml
@@ -0,0 +1,15 @@
+name: Upload bin assets
+description: Uploads the provider and tfgen binaries to `bin/`.
+
+runs:
+  using: "composite"
+  steps:
+    - name: Tar provider binaries
+      shell: bash
+      run: tar -zcf ${{ github.workspace }}/bin/provider.tar.gz -C ${{ github.workspace }}/bin/ pulumi-resource-talos pulumi-tfgen-talos
+    - name: Upload artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: talos-provider.tar.gz
+        path: ${{ github.workspace }}/bin/provider.tar.gz
+        retention-days: 30
diff --git a/.github/actions/upload-sdk/action.yml b/.github/actions/upload-sdk/action.yml
new file mode 100644
index 00000000..77d48494
--- /dev/null
+++ b/.github/actions/upload-sdk/action.yml
@@ -0,0 +1,20 @@
+name: Upload SDK asset
+description: Upload the SDK for a specific language as an asset for the workflow.
+
+inputs:
+  language:
+    required: true
+    description: One of nodejs, python, dotnet, go, java
+
+runs:
+  using: "composite"
+  steps:
+    - name: Compress SDK folder
+      shell: bash
+      run: tar -zcf sdk/${{ inputs.language }}.tar.gz -C sdk/${{ inputs.language }} .
+    - name: Upload artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: ${{ inputs.language  }}-sdk.tar.gz
+        path: ${{ github.workspace}}/sdk/${{ inputs.language }}.tar.gz
+        retention-days: 30
diff --git a/.github/workflows/build_provider.yml b/.github/workflows/build_provider.yml
new file mode 100644
index 00000000..e259ccb0
--- /dev/null
+++ b/.github/workflows/build_provider.yml
@@ -0,0 +1,58 @@
+name: "Build Provider"
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        required: true
+        type: string
+        description: Version of the provider to build
+
+jobs:
+  build_provider:
+    name: Build ${{ matrix.platform.os }}-${{ matrix.platform.arch }}
+    runs-on: ubuntu-latest
+    env:
+      PROVIDER_VERSION: ${{ inputs.version }}
+    strategy:
+      fail-fast: true
+      matrix:
+        platform:
+          - os: linux
+            arch: amd64
+          - os: linux
+            arch: arm64
+          - os: darwin
+            arch: amd64
+          - os: darwin
+            arch: arm64
+          - os: windows
+            arch: amd64
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Setup tools
+        uses: ./.github/actions/setup-tools
+        with:
+          tools: pulumictl, go
+      - name: Download schema-embed.json
+        uses: actions/download-artifact@v4
+        with:
+          # Use a pattern to avoid failing if the artifact doesn't exist
+          pattern: schema-embed.*
+          # Avoid creating directories for each artifact
+          merge-multiple: true
+          path: provider/cmd/pulumi-resource-talos/schema-embed.json
+      - name: Prepare for build
+        # This installs plugins and prepares upstream
+        run: make upstream
+      - name: Build & package provider
+        run: make provider_dist-${{ matrix.platform.os }}-${{ matrix.platform.arch }}
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: pulumi-resource-talos-v${{ inputs.version }}-${{ matrix.platform.os }}-${{ matrix.platform.arch }}.tar.gz
+          path: bin/pulumi-resource-talos-v${{ inputs.version }}-${{ matrix.platform.os }}-${{ matrix.platform.arch }}.tar.gz
+          retention-days: 30
diff --git a/.github/workflows/build_sdk.yml b/.github/workflows/build_sdk.yml
new file mode 100644
index 00000000..ae541774
--- /dev/null
+++ b/.github/workflows/build_sdk.yml
@@ -0,0 +1,76 @@
+name: "Build SDK"
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        required: true
+        type: string
+
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
+  PULUMI_API: https://api.pulumi-staging.io
+  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
+  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
+  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+  PYPI_USERNAME: __token__
+  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+  TF_APPEND_USER_AGENT: pulumi
+  PROVIDER_VERSION: ${{ inputs.version }}
+
+jobs:
+  build_sdk:
+    name: build_sdk
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: true
+      matrix:
+        language:
+        - dotnet
+        - go
+        - nodejs
+        - python
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Cache examples generation
+        uses: actions/cache@v4
+        with:
+          path: |
+            .pulumi/examples-cache
+          key: ${{ runner.os }}-${{ hashFiles('provider/go.sum') }}
+      - name: Setup tools
+        uses: ./.github/actions/setup-tools
+        with:
+          tools: pulumictl, pulumicli, ${{ matrix.language }}
+      - name: Download bin
+        uses: ./.github/actions/download-bin
+      - name: Install plugins
+        run: make install_plugins
+      - name: Update path
+        run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
+      - name: Build SDK
+        run: make build_${{ matrix.language }}
+      - name: Check worktree clean
+        uses: pulumi/git-status-check-action@v1
+        with:
+          allowed-changes: |
+            sdk/**/pulumi-plugin.json
+            sdk/dotnet/*.csproj
+            sdk/go/**/pulumiUtilities.go
+            sdk/nodejs/package.json
+            sdk/python/pyproject.toml
+      - name: Upload SDK
+        uses: ./.github/actions/upload-sdk
+        with:
+          language: ${{ matrix.language }}
diff --git a/.github/workflows/license.yml b/.github/workflows/license.yml
new file mode 100644
index 00000000..ce6c5e43
--- /dev/null
+++ b/.github/workflows/license.yml
@@ -0,0 +1,61 @@
+# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
+
+name: license_check
+
+on:
+  workflow_call:
+    inputs: {}
+
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
+  PULUMI_API: https://api.pulumi-staging.io
+  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
+  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
+  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+  PYPI_USERNAME: __token__
+  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+  TF_APPEND_USER_AGENT: pulumi
+
+jobs:
+  license_check:
+    name: License Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Setup tools
+        uses: ./.github/actions/setup-tools
+        with:
+          tools: go
+      - run: make upstream
+      - uses: pulumi/license-check-action@main
+        with:
+          module-path: provider
+          ignore-modules: >-
+            github.com/aead/chacha20,
+            github.com/apache/arrow/go/v12,
+            github.com/apache/thrift/lib/go/thrift,
+            github.com/cloudflare/circl,
+            github.com/golang,
+            github.com/gorhill/cronexpr,
+            github.com/in-toto/in-toto-golang,
+            github.com/jmespath/go-jmespath,
+            github.com/keybase/go-crypto,
+            github.com/klauspost/compress,
+            github.com/mattn/go-localereader,
+            github.com/modern-go/reflect2,
+            github.com/pierrec/lz4,
+            github.com/pjbgf/sha1cd,
+            github.com/pulumi,
+            github.com/segmentio/asm,
+            golang.org
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
new file mode 100644
index 00000000..988e3b2a
--- /dev/null
+++ b/.github/workflows/lint.yml
@@ -0,0 +1,54 @@
+# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
+
+name: lint
+
+on:
+  workflow_call:
+    inputs: {}
+
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
+  PULUMI_API: https://api.pulumi-staging.io
+  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
+  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
+  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+  PYPI_USERNAME: __token__
+  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+  TF_APPEND_USER_AGENT: pulumi
+
+jobs:
+  lint:
+    name: lint
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout Repo
+      uses: actions/checkout@v4
+      with:
+        persist-credentials: false
+    - name: Install go
+      uses: actions/setup-go@v5
+      with:
+        # The versions of golangci-lint and setup-go here cross-depend and need to update together.
+        go-version: 1.23
+        # Either this action or golangci-lint needs to disable the cache
+        cache: false
+    - name: disarm go:embed directives to enable lint
+      continue-on-error: true # this fails if there are no go:embed directives
+      run: |
+        git grep -l 'go:embed' -- provider | xargs sed -i 's/go:embed/ goembed/g'
+    - name: prepare upstream
+      continue-on-error: true
+      run: make upstream
+    - name: golangci-lint
+      uses: golangci/golangci-lint-action@v6
+      with:
+        version: v1.60
+        working-directory: provider
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 0108ce93..fe3d3780 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -1,243 +1,191 @@
+# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
+
 env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
   NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
   NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
-  PROVIDER: talos
+  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
   PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
-  PULUMI_API: https://api.pulumi.com
+  PULUMI_API: https://api.pulumi-staging.io
   PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
   PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
-  PULUMI_TEST_OWNER: "pulumiverse"
   PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
-  PYPI_USERNAME: "__token__"
-  TRAVIS_OS_NAME: linux
-  DOTNETVERSION: |
-      6.0.x
-      3.1.301
-  GOVERSION: 1.22.x
-  GRADLEVERSION: "7.6"
-  JAVAVERSION: "11"
-  NODEVERSION: 20.x
-  PYTHONVERSION: 3.11.8
-
+  PYPI_USERNAME: __token__
+  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+  TF_APPEND_USER_AGENT: pulumi
 jobs:
+  prerequisites:
+    uses: ./.github/workflows/prerequisites.yml
+    secrets: inherit
+    with:
+      default_branch: ${{ github.event.repository.default_branch }}
+      is_pr: ${{ github.event_name == 'pull_request' }}
+      is_automated: ${{ github.actor == 'dependabot[bot]' }}
+
+  build_provider:
+    uses: ./.github/workflows/build_provider.yml
+    needs: prerequisites
+    secrets: inherit
+    with:
+      version: ${{ needs.prerequisites.outputs.version }}
+
   build_sdk:
     name: build_sdk
     needs: prerequisites
+    uses: ./.github/workflows/build_sdk.yml
+    secrets: inherit
+    with:
+      version: ${{ needs.prerequisites.outputs.version }}
+
+  generate_coverage_data:
+    continue-on-error: true
+    env:
+      COVERAGE_OUTPUT_DIR: ${{ secrets.COVERAGE_OUTPUT_DIR }}
+    name: generate_coverage_data
+    needs: prerequisites
     runs-on: ubuntu-latest
     steps:
-    - name: Checkout Repo
-      uses: actions/checkout@v3
-    - name: Checkout Scripts Repo
-      uses: actions/checkout@v3
-      with:
-        path: ci-scripts
-        repository: jaxxstorm/scripts
-        ref: third_party
-    - name: Unshallow clone for tags
-      run: git fetch --prune --unshallow --tags
-    - name: Install Go
-      uses: actions/setup-go@v3
-      with:
-        go-version: ${{ env.GOVERSION }}
-    - name: Install pulumictl
-      uses: jaxxstorm/action-install-gh-release@v1.9.0
-      with:
-        repo: pulumi/pulumictl
-    - name: Install Pulumi CLI
-      uses: pulumi/action-install-pulumi-cli@v2
-    - name: Setup Node
-      uses: actions/setup-node@v4
-      with:
-        node-version: ${{ env.NODEVERSION }}
-        registry-url: https://registry.npmjs.org
-    - name: Setup DotNet
-      uses: actions/setup-dotnet@v3
-      with:
-        dotnet-version: ${{ env.DOTNETVERSION }}
-    - name: Setup Python
-      uses: actions/setup-python@v4
+    - name: Free Disk Space (Ubuntu)
+      uses: jlumbroso/free-disk-space@v1.3.1
       with:
-        python-version: ${{ env.PYTHONVERSION }}
-    - name: Download provider + tfgen binaries
-      uses: actions/download-artifact@v3
-      with:
-        name: ${{ env.PROVIDER }}-provider.tar.gz
-        path: ${{ github.workspace }}/bin
-    - name: Untar provider binaries
-      run: |-
-        tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{ github.workspace}}/bin
-        find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print -exec chmod +x {} \;
-    - name: Install plugins
-      run: make install_plugins
-    - name: Update path
-      run: echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
-    - name: Build SDK
-      run: make build_${{ matrix.language }}
-    - name: Check worktree clean
-      run: ./ci-scripts/ci/check-worktree-is-clean
-    - name: Compress SDK folder
-      run: tar -zcf sdk/${{ matrix.language }}.tar.gz -C sdk/${{ matrix.language }}
-        .
-    - name: Upload artifacts
-      uses: actions/upload-artifact@v3
-      with:
-        name: ${{ matrix.language  }}-sdk.tar.gz
-        path: ${{ github.workspace}}/sdk/${{ matrix.language }}.tar.gz
-    strategy:
-      fail-fast: true
-      matrix:
-        language:
-        - nodejs
-        - python
-        - dotnet
-        - go
+        tool-cache: false
+        swap-storage: false
+    - name: Checkout Repo
+      uses: actions/checkout@v4
+      with:
+        persist-credentials: false
+    - name: Configure AWS Credentials
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        aws-access-key-id: ${{ secrets.AWS_CORP_S3_UPLOAD_ACCESS_KEY_ID }}
+        aws-region: us-west-2
+        aws-secret-access-key: ${{ secrets.AWS_CORP_S3_UPLOAD_SECRET_ACCESS_KEY }}
+    - name: Setup tools
+      uses: ./.github/actions/setup-tools
+      with:
+        tools: pulumictl, pulumicli, go, schema-tools
+    - name: Echo Coverage Output Dir
+      run: 'echo "Coverage output directory: ${{ env.COVERAGE_OUTPUT_DIR }}"'
+    - name: Generate Coverage Data
+      run: PULUMI_MISSING_DOCS_ERROR=true make tfgen
+    - name: Summarize Provider Coverage Results
+      run: cat ${{ env.COVERAGE_OUTPUT_DIR }}/shortSummary.txt
+    - name: Upload coverage data to S3
+      run: >-
+        summaryName="${PROVIDER}_summary_$(date +"%Y-%m-%d_%H-%M-%S").json"
 
-  prerequisites:
-    name: prerequisites
+        s3FullURI="s3://${{ secrets.S3_COVERAGE_BUCKET_NAME }}/summaries/${summaryName}"
+
+        aws s3 cp "${{ env.COVERAGE_OUTPUT_DIR }}/summary.json" "${s3FullURI}" --acl bucket-owner-full-control
+  lint:
+    name: lint
+    uses: ./.github/workflows/lint.yml
+    secrets: inherit
+  license_check:
+    name: License Check
+    uses: ./.github/workflows/license.yml
+    secrets: inherit
+
+  publish:
+    name: publish
+    permissions:
+      contents: write
+    needs:
+      - prerequisites
+      - build_provider
+      - test
+      - license_check
+    uses: ./.github/workflows/publish.yml
+    secrets: inherit
+    with:
+      version: ${{ needs.prerequisites.outputs.version }}
+      isPrerelease: true
+      skipGoSdk: true
+
+  tag_release_if_labeled_needs_release:
+    name: Tag release if labeled as needs-release
+    needs: publish
     runs-on: ubuntu-latest
     steps:
-    - name: Checkout Repo
-      uses: actions/checkout@v3
-    - name: Checkout Scripts Repo
-      uses: actions/checkout@v3
-      with:
-        path: ci-scripts
-        repository: jaxxstorm/scripts
-        ref: third_party
-    - name: Unshallow clone for tags
-      run: git fetch --prune --unshallow --tags
-    - name: Install Go
-      uses: actions/setup-go@v3
-      with:
-        go-version: ${{ env.GOVERSION }}
-    - name: Install pulumictl
-      uses: jaxxstorm/action-install-gh-release@v1.9.0
-      with:
-        repo: pulumi/pulumictl
-    - name: Install Pulumi CLI
-      uses: pulumi/action-install-pulumi-cli@v2
-    - if: github.event_name == 'pull_request'
-      name: Install Schema Tools
-      uses: jaxxstorm/action-install-gh-release@v1.9.0
-      with:
-        repo: mikhailshilkov/schema-tools
-    - name: Build tfgen & provider binaries
-      run: make provider
-    # - if: github.event_name == 'pull_request'
-    #   name: Check Schema is Valid
-    #   run: |-
-    #     echo 'SCHEMA_CHANGES<<EOF' >> $GITHUB_ENV
-    #     schema-tools compare ${{ env.PROVIDER }} master --local-path=provider/cmd/pulumi-resource-${{ env.PROVIDER }}/schema.json >> $GITHUB_ENV
-    #     echo 'EOF' >> $GITHUB_ENV
-    # - if: github.event_name == 'pull_request'
-    #   name: Comment on PR with Details of Schema Check
-    #   uses: thollander/actions-comment-pull-request@1.0.1
-    #   with:
-    #     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    #     message: |
-    #       ### Does the PR have any schema changes?
-
-    #       ${{ env.SCHEMA_CHANGES }}
-    - name: Tar provider binaries
-      run: tar -zcf ${{ github.workspace }}/bin/provider.tar.gz -C ${{ github.workspace
-        }}/bin/ pulumi-resource-${{ env.PROVIDER }} pulumi-tfgen-${{ env.PROVIDER
-        }}
-    - name: Upload artifacts
-      uses: actions/upload-artifact@v3
-      with:
-        name: ${{ env.PROVIDER }}-provider.tar.gz
-        path: ${{ github.workspace }}/bin/provider.tar.gz
-    strategy:
-      fail-fast: true
+    - name: check if this commit needs release
+      if: ${{ env.RELEASE_BOT_ENDPOINT != '' }}
+      uses: pulumi/action-release-by-pr-label@main
+      with:
+        command: "release-if-needed"
+        repo: ${{ github.repository }}
+        commit: ${{ github.sha }}
+        slack_channel: ${{ secrets.RELEASE_OPS_SLACK_CHANNEL }}
+      env:
+        RELEASE_BOT_ENDPOINT: ${{ secrets.RELEASE_BOT_ENDPOINT }}
+        RELEASE_BOT_KEY: ${{ secrets.RELEASE_BOT_KEY }}
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   test:
     name: test
-    needs: build_sdk
+    needs:
+      - prerequisites
+      - build_sdk
+    permissions:
+      contents: read
+      id-token: write
     runs-on: ubuntu-latest
+    env:
+      PROVIDER_VERSION: ${{ needs.prerequisites.outputs.version }}
     steps:
     - name: Checkout Repo
-      uses: actions/checkout@v3
-    - name: Checkout Scripts Repo
-      uses: actions/checkout@v3
-      with:
-        path: ci-scripts
-        repository: jaxxstorm/scripts
-        ref: third_party
-    - name: Unshallow clone for tags
-      run: git fetch --prune --unshallow --tags
-    - name: Install Go
-      uses: actions/setup-go@v3
-      with:
-        go-version: ${{ env.GOVERSION }}
-    - name: Install pulumictl
-      uses: jaxxstorm/action-install-gh-release@v1.9.0
-      with:
-        repo: pulumi/pulumictl
-    - name: Install Pulumi CLI
-      uses: pulumi/action-install-pulumi-cli@v2
-    - name: Setup Node
-      uses: actions/setup-node@v4
-      with:
-        node-version: ${{ env.NODEVERSION }}
-        registry-url: https://registry.npmjs.org
-    - name: Setup DotNet
-      uses: actions/setup-dotnet@v3
-      with:
-        dotnet-version: ${{ env.DOTNETVERSION }}
-    - name: Setup Python
-      uses: actions/setup-python@v4
-      with:
-        python-version: ${{ env.PYTHONVERSION }}
-    - name: Download provider + tfgen binaries
-      uses: actions/download-artifact@v3
-      with:
-        name: ${{ env.PROVIDER }}-provider.tar.gz
-        path: ${{ github.workspace }}/bin
-    - name: Untar provider binaries
-      run: |-
-        tar -zxf ${{ github.workspace }}/bin/provider.tar.gz -C ${{ github.workspace}}/bin
-        find ${{ github.workspace }} -name "pulumi-*-${{ env.PROVIDER }}" -print -exec chmod +x {} \;
-    - run: dotnet nuget add source ${{ github.workspace }}/nuget
+      uses: actions/checkout@v4
+      with:
+        persist-credentials: false
+    - name: Setup tools
+      uses: ./.github/actions/setup-tools
+      with:
+        tools: pulumictl, pulumicli, ${{ matrix.language }}
+    - name: Download bin
+      uses: ./.github/actions/download-bin
+    - name: Add NuGet source
+      if: matrix.language == 'dotnet'
+      run: dotnet nuget add source ${{ github.workspace }}/nuget
     - name: Download SDK
-      uses: actions/download-artifact@v3
+      uses: ./.github/actions/download-sdk
       with:
-        name: ${{ matrix.language }}-sdk.tar.gz
-        path: ${{ github.workspace}}/sdk/
-    - name: Uncompress SDK folder
-      run: tar -zxf ${{ github.workspace }}/sdk/${{ matrix.language }}.tar.gz -C ${{
-        github.workspace }}/sdk/${{ matrix.language }}
+        language: ${{ matrix.language }}
     - name: Update path
-      run: echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
+      run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
     - name: Install Python deps
+      if: matrix.language == 'python'
       run: |-
         pip3 install virtualenv==20.0.23
         pip3 install pipenv
     - name: Install dependencies
       run: make install_${{ matrix.language}}_sdk
+    - name: Install gotestfmt
+      uses: GoTestTools/gotestfmt-action@v2
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+        version: v2.5.0
     - name: Run tests
-      run: cd examples && go test -v -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4 .
+      run: cd examples && go test -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4
     strategy:
-      fail-fast: true
+      fail-fast: false
       matrix:
         language:
-        - nodejs
-        - python
         - dotnet
         - go
-
-permissions:
-  contents: write
-
+        - nodejs
+        - python
 name: main
-"on":
+on:
+  workflow_dispatch: {}
   push:
     branches:
     - main
     paths-ignore:
-    - CHANGELOG.md
+    - "**.md"
     tags-ignore:
     - v*
     - sdk/*
-    - '**'
+    - "**"
diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml
new file mode 100644
index 00000000..b561ef30
--- /dev/null
+++ b/.github/workflows/prerelease.yml
@@ -0,0 +1,127 @@
+# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
+
+env:
+  IS_PRERELEASE: true
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
+  PULUMI_API: https://api.pulumi-staging.io
+  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
+  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
+  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+  PYPI_USERNAME: __token__
+  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+  TF_APPEND_USER_AGENT: pulumi
+jobs:
+  prerequisites:
+    uses: ./.github/workflows/prerequisites.yml
+    secrets: inherit
+    with:
+      default_branch: ${{ github.event.repository.default_branch }}
+      is_pr: ${{ github.event_name == 'pull_request' }}
+      is_automated: ${{ github.actor == 'dependabot[bot]' }}
+
+  build_provider:
+    uses: ./.github/workflows/build_provider.yml
+    needs: prerequisites
+    secrets: inherit
+    with:
+      version: ${{ needs.prerequisites.outputs.version }}
+
+  build_sdk:
+    name: build_sdk
+    needs: prerequisites
+    uses: ./.github/workflows/build_sdk.yml
+    secrets: inherit
+    with:
+      version: ${{ needs.prerequisites.outputs.version }}
+
+  lint:
+    name: lint
+    uses: ./.github/workflows/lint.yml
+    secrets: inherit
+  license_check:
+    name: License Check
+    uses: ./.github/workflows/license.yml
+    secrets: inherit
+
+  publish:
+    name: publish
+    permissions:
+      contents: write
+    needs:
+      - prerequisites
+      - build_provider
+      - test
+      - license_check
+    uses: ./.github/workflows/publish.yml
+    secrets: inherit
+    with:
+      version: ${{ needs.prerequisites.outputs.version }}
+      isPrerelease: true
+
+  test:
+    name: test
+    needs:
+      - prerequisites
+      - build_sdk
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    env:
+      PROVIDER_VERSION: ${{ needs.prerequisites.outputs.version }}
+    steps:
+    - name: Checkout Repo
+      uses: actions/checkout@v4
+      with:
+        persist-credentials: false
+    - name: Setup tools
+      uses: ./.github/actions/setup-tools
+      with:
+        tools: pulumictl, pulumicli, dotnet, go, nodejs, python
+    - name: Download bin
+      uses: ./.github/actions/download-bin
+    - name: Add NuGet source
+      if: matrix.language == 'dotnet'
+      run: dotnet nuget add source ${{ github.workspace }}/nuget
+    - name: Download SDK
+      uses: ./.github/actions/download-sdk
+      with:
+        language: ${{ matrix.language }}
+    - name: Update path
+      run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
+    - name: Install Python deps
+      if: matrix.language == 'python'
+      run: |-
+        pip3 install virtualenv==20.0.23
+        pip3 install pipenv
+    - name: Install dependencies
+      run: make install_${{ matrix.language}}_sdk
+    - name: Install gotestfmt
+      uses: GoTestTools/gotestfmt-action@v2
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+        version: v2.5.0
+    - name: Run tests
+      run: cd examples && go test -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4 .
+    strategy:
+      fail-fast: false
+      matrix:
+        language:
+        - dotnet
+        - go
+        - nodejs
+        - python
+
+name: prerelease
+on:
+  push:
+    tags:
+    - v*.*.*-**
diff --git a/.github/workflows/prerequisites.yml b/.github/workflows/prerequisites.yml
new file mode 100644
index 00000000..125ae039
--- /dev/null
+++ b/.github/workflows/prerequisites.yml
@@ -0,0 +1,104 @@
+name: "Prerequisites"
+
+on:
+  workflow_call:
+    inputs:
+      is_pr:
+        type: boolean
+        required: true
+      is_automated:
+        type: boolean
+        required: true
+      default_branch:
+        type: string
+        required: true
+    outputs:
+      version:
+        description: "Provider version being built"
+        value: ${{ jobs.prerequisites.outputs.version }}
+
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
+  PULUMI_API: https://api.pulumi-staging.io
+  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
+  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
+  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+  PYPI_USERNAME: __token__
+  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+  TF_APPEND_USER_AGENT: pulumi
+
+jobs:
+  prerequisites:
+    name: prerequisites
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.provider-version.outputs.version }}
+    steps:
+    - name: Checkout Repo
+      uses: actions/checkout@v4
+      with:
+        persist-credentials: false
+    - uses: pulumi/provider-version-action@v1
+      id: provider-version
+      with:
+        set-env: 'PROVIDER_VERSION'
+    - name: Cache examples generation
+      uses: actions/cache@v4
+      with:
+        path: |
+          .pulumi/examples-cache
+        key: ${{ runner.os }}-${{ hashFiles('provider/go.sum') }}
+    - name: Prepare upstream code
+      run: make upstream
+    - name: Setup tools
+      uses: ./.github/actions/setup-tools
+      with:
+        tools: go, pulumictl, pulumicli, schema-tools
+    - name: Build schema generator binary
+      run: make tfgen_build_only
+    - name: Install plugins
+      run: make install_plugins
+    - name: Generate schema
+      run: make tfgen_no_deps
+    - name: Build provider binary
+      run: make provider_no_deps
+    - name: Unit-test provider code
+      run: make test_provider
+    - if: inputs.is_pr
+      name: Check Schema is Valid
+      run: |
+        EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
+        {
+          echo "SCHEMA_CHANGES<<$EOF";
+          schema-tools compare -r github://api.github.com/pulumiverse -p talos -o "${{ inputs.default_branch }}" -n --local-path=provider/cmd/pulumi-resource-talos/schema.json;
+          echo "$EOF";
+        } >> "$GITHUB_ENV"
+    - if: inputs.is_pr && inputs.is_automated == false
+      name: Comment on PR with Details of Schema Check
+      uses: thollander/actions-comment-pull-request@v2
+      with:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        comment_tag: schemaCheck
+        message: >+
+          ${{ env.SCHEMA_CHANGES }}
+
+
+          Maintainer note: consult the [runbook](https://github.com/pulumi/platform-providers-team/blob/main/playbooks/tf-provider-updating.md) for dealing with any breaking changes.
+
+    - name: Upload bin
+      uses: ./.github/actions/upload-bin
+
+    - name: Upload schema-embed.json
+      uses: actions/upload-artifact@v4
+      with:
+        name: schema-embed.json
+        path: provider/cmd/pulumi-resource-talos/schema-embed.json
+        retention-days: 30
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 00000000..5d9159cb
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,163 @@
+# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
+name: Publish
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        required: true
+        type: string
+      isPrerelease:
+        required: true
+        type: boolean
+      skipGoSdk:
+        default: false
+        type: boolean
+        description: Skip publishing & verifying the Go SDK
+
+env:
+  IS_PRERELEASE: ${{ inputs.isPrerelease }}
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
+  PULUMI_API: https://api.pulumi-staging.io
+  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
+  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
+  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+  PYPI_USERNAME: __token__
+  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+  TF_APPEND_USER_AGENT: pulumi
+
+jobs:
+  publish:
+    name: publish
+    runs-on: ubuntu-latest
+    steps:
+    - name: Validate prerelease
+      if: inputs.isPrerelease == false && (contains(inputs.version, '-') || contains(inputs.version, '+'))
+      run: echo "Can't publish a prerelease version as a stable release. This is likely a bug in the calling workflow." && exit 1
+    - name: Validate skipGoSdk
+      if: inputs.skipGoSdk && inputs.isPrerelease == false
+      run: echo "Can't skip Go SDK for stable releases. This is likely a bug in the calling workflow." && exit 1
+    - name: Checkout Repo
+      uses: actions/checkout@v4
+      with:
+        persist-credentials: false
+    - name: Setup tools
+      uses: ./.github/actions/setup-tools
+      with:
+        tools: pulumictl, pulumicli, go, schema-tools
+    - name: Create dist directory
+      run: mkdir -p dist
+    - name: Download provider assets
+      uses: actions/download-artifact@v4
+      with:
+        pattern: pulumi-resource-talos-v${{ inputs.version }}-*
+        path: dist
+        # Don't create a directory for each artifact
+        merge-multiple: true
+    - name: Calculate checksums
+      working-directory: dist
+      run: shasum ./*.tar.gz > "pulumi-talos_${{ inputs.version }}_checksums.txt"
+    - name: Get Schema Change Summary
+      id: schema-summary
+      shell: bash
+      run: |
+        # Get latest stable release. Return only first column from result (tag).
+        LAST_VERSION=$(gh release view --repo pulumiverse/pulumi-talos --json tagName -q .tagName || echo "No stable release" )
+        {
+          echo 'summary<<EOF'
+          if [[ "$LAST_VERSION" != "No stable release" ]]; then
+            schema-tools compare --provider="talos" --old-commit="$LAST_VERSION" --repository="github://api.github.com/pulumiverse" --new-commit="--local-path=provider/cmd/pulumi-resource-talos/schema.json"
+          fi
+          echo 'EOF'
+        } >> "$GITHUB_OUTPUT"
+    - name: Create GH Release
+      uses: softprops/action-gh-release@v1
+      if: inputs.isPrerelease == false
+      with:
+        tag_name: v${{ inputs.version }}
+        prerelease: ${{ inputs.isPrerelease }}
+        # We keep pre-releases as drafts so they're not visible until we manually publish them.
+        draft: ${{ inputs.isPrerelease }}
+        body: ${{ steps.schema-summary.outputs.summary }}
+        generate_release_notes: true
+        files: dist/*
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  publish_sdk:
+    name: publish_sdk
+    needs: publish
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout Repo
+      uses: actions/checkout@v4
+      with:
+        # Persist credentials so we can push back to the repo
+        persist-credentials: true
+    - name: Setup tools
+      uses: ./.github/actions/setup-tools
+      with:
+        tools: pulumictl, pulumicli, dotnet, go, nodejs, python
+    - name: Publish SDKs
+      uses: pulumi/pulumi-package-publisher@v0.0.20
+      with:
+        sdk: all,!java
+        version: ${{ inputs.version }}
+    - name: Download Go SDK
+      uses: ./.github/actions/download-sdk
+      with:
+        language: go
+    - uses: pulumi/publish-go-sdk-action@v1
+      if: inputs.skipGoSdk == false
+      with:
+        repository: ${{ github.repository }}
+        base-ref: ${{ github.sha }}
+        source: sdk
+        path: sdk
+        version: ${{ inputs.version }}
+        additive: false
+        # Avoid including other language SDKs & artifacts in the commit
+        files: |
+          go.*
+          go/**
+          !*.tar.gz
+
+  clean_up_release_labels:
+    name: Clean up release labels
+    # Only run for non-prerelease, if the publish_go_sdk job was successful or skipped
+    if: inputs.isPrerelease == false
+    
+    needs: publish_sdk
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout Repo
+      uses: actions/checkout@v4
+      with:
+        persist-credentials: false
+    - name: Clean up release labels
+      uses: pulumi/action-release-by-pr-label@main
+      with:
+        command: "clean-up-release-labels"
+        repo: ${{ github.repository }}
+        commit: ${{ github.sha }}
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  verify_release:
+    name: verify_release
+    needs: publish_sdk
+    uses: ./.github/workflows/verify-release.yml
+    secrets: inherit
+    with:
+      providerVersion: ${{ inputs.version }}
+      # Prelease is run often but we only have 5 concurrent macos runners, so we only test after the stable release.
+      enableMacosRunner: ${{ inputs.isPrerelease == false }}
+      skipGoSdk: ${{ inputs.skipGoSdk }}
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
new file mode 100644
index 00000000..beb84a89
--- /dev/null
+++ b/.github/workflows/pull-request.yml
@@ -0,0 +1,40 @@
+# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
+
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
+  PULUMI_API: https://api.pulumi-staging.io
+  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
+  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
+  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+  PYPI_USERNAME: __token__
+  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+  TF_APPEND_USER_AGENT: pulumi
+jobs:
+  comment-on-pr:
+    if: github.event.pull_request.head.repo.full_name != github.repository
+    name: comment-on-pr
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout Repo
+      uses: actions/checkout@v4
+      with:
+        persist-credentials: false
+    - name: Comment PR
+      uses: thollander/actions-comment-pull-request@v2
+      with:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        message: >
+          PR is now waiting for a maintainer to run the acceptance tests.
+
+          **Note for the maintainer:** To run the acceptance tests, please comment */run-acceptance-tests* on the PR
+name: pull-request
+on:
+  pull_request_target: {}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
deleted file mode 100644
index ec3cf406..00000000
--- a/.github/workflows/release.yaml
+++ /dev/null
@@ -1,140 +0,0 @@
-name: release
-
-on:
-  push:
-    tags:
-      - v*.*.*
-
-permissions:
-  contents: write
-  id-token: write
-
-env:
-  PROVIDER: talos
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
-  NUGET_FEED_URL: https://api.nuget.org/v3/index.json
-  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
-  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
-  PYPI_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
-  PYPI_USERNAME: "__token__"
-  PUBLISH_PYPI: true
-  PUBLISH_NPM: true
-  PUBLISH_NUGET: true
-  DOTNETVERSION: |
-      6.0.x
-      3.1.301
-  GOVERSION: 1.22.x
-  GRADLEVERSION: "7.6"
-  JAVAVERSION: "11"
-  NODEVERSION: 20.x
-  PYTHONVERSION: 3.11.8
-
-jobs:
-  publish_binary:
-    name: publish
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v4.1.1
-      - name: Unshallow clone for tags
-        run: git fetch --prune --unshallow --tags
-      - name: Install Go
-        uses: actions/setup-go@v4.1.0
-        with:
-          go-version: ${{env.GOVERSION}}
-      - name: Install pulumictl
-        uses: jaxxstorm/action-install-gh-release@v1.10.0
-        with:
-          repo: pulumi/pulumictl
-      - name: Set PreRelease Version
-        run: echo "GORELEASER_CURRENT_TAG=v$(pulumictl get version --language generic)" >> $GITHUB_ENV
-      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v5.0.0
-        with:
-          args: -p 3 release --rm-dist
-          version: latest
-      - name: Create tag
-        uses: actions/github-script@v6.4.1
-        with:
-          script: |
-            github.rest.git.createRef({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              ref: 'refs/tags/sdk/${{ github.ref_name }}',
-              sha: context.sha
-            })
-    strategy:
-      fail-fast: true
-
-  publish_sdk:
-    name: Publish SDKs
-    runs-on: ubuntu-latest
-    needs: publish_binary
-    steps:
-      - name: Checkout Repo
-        uses: actions/checkout@v4.1.1
-      - name: Unshallow clone for tags
-        run: git fetch --prune --unshallow --tags
-      - name: Install Go
-        uses: actions/setup-go@v4.1.0
-        with:
-          go-version: ${{ env.GOVERSION }}
-      - name: Install pulumictl
-        uses: jaxxstorm/action-install-gh-release@v1.10.0
-        with:
-          repo: pulumi/pulumictl
-      - name: Install Pulumi CLI
-        uses: pulumi/actions@v4
-      - name: Setup Node
-        uses: actions/setup-node@v4.0.2
-        with:
-          node-version: ${{ env.NODEVERSION }}
-      - name: Setup DotNet
-        uses: actions/setup-dotnet@v2.1.1
-        with:
-          dotnet-version: ${{ env.DOTNETVERSION }}
-      - name: Setup Python
-        uses: actions/setup-python@v4.7.1
-        with:
-          python-version: ${{ env.PYTHONVERSION }}
-      - name: Build SDK
-        run: make build_${{ matrix.language }}
-      - name: Check worktree clean
-        run: |
-          git update-index -q --refresh
-          if ! git diff-files --quiet; then
-              >&2 echo "error: working tree is not clean, aborting!"
-              git status
-              git diff
-              exit 1
-          fi
-      - if: ${{ matrix.language == 'python' && env.PUBLISH_PYPI == 'true' }}
-        name: Publish package to PyPI
-        uses: pypa/gh-action-pypi-publish@v1.8.10
-        with:
-          user: ${{ env.PYPI_USERNAME }}
-          password: ${{ env.PYPI_PASSWORD }}
-          packages_dir: ${{github.workspace}}/sdk/python/bin/dist
-      - if: ${{ matrix.language == 'nodejs' && env.PUBLISH_NPM == 'true' }}
-        uses: JS-DevTools/npm-publish@v2.2.2
-        with:
-          access: "public"
-          token: ${{ env.NPM_TOKEN }}
-          package: ${{github.workspace}}/sdk/nodejs/bin/package.json
-          provenance: true
-      - if: ${{ matrix.language == 'dotnet' && env.PUBLISH_NUGET == 'true' }}
-        name: publish nuget package
-        run: |
-          dotnet nuget push ${{github.workspace}}/sdk/dotnet/bin/Debug/*.nupkg -s ${{ env.NUGET_FEED_URL }} -k ${{ env.NUGET_PUBLISH_KEY }}
-          echo "done publishing packages"
-    strategy:
-      fail-fast: true
-      matrix:
-        language:
-          - nodejs
-          - python
-          - dotnet
-          - go
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 00000000..aa6276fe
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,127 @@
+# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
+name: release
+on:
+  push:
+    tags:
+    - v*.*.*
+    - "!v*.*.*-**"
+
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
+  PULUMI_API: https://api.pulumi-staging.io
+  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
+  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
+  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+  PYPI_USERNAME: __token__
+  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+  TF_APPEND_USER_AGENT: pulumi
+jobs:
+  prerequisites:
+    uses: ./.github/workflows/prerequisites.yml
+    secrets: inherit
+    with:
+      default_branch: ${{ github.event.repository.default_branch }}
+      is_pr: ${{ github.event_name == 'pull_request' }}
+      is_automated: ${{ github.actor == 'dependabot[bot]' }}
+
+  build_provider:
+    uses: ./.github/workflows/build_provider.yml
+    needs: prerequisites
+    secrets: inherit
+    with:
+      version: ${{ needs.prerequisites.outputs.version }}
+
+  build_sdk:
+    name: build_sdk
+    needs: prerequisites
+    uses: ./.github/workflows/build_sdk.yml
+    secrets: inherit
+    with:
+      version: ${{ needs.prerequisites.outputs.version }}
+
+  lint:
+    name: lint
+    uses: ./.github/workflows/lint.yml
+    secrets: inherit
+  license_check:
+    name: License Check
+    uses: ./.github/workflows/license.yml
+    secrets: inherit
+
+  publish:
+    name: publish
+    permissions:
+      contents: write
+      pull-requests: write
+    needs:
+      - prerequisites
+      - build_provider
+      - test
+      - license_check
+    uses: ./.github/workflows/publish.yml
+    secrets: inherit
+    with:
+      version: ${{ needs.prerequisites.outputs.version }}
+      isPrerelease: false
+
+  test:
+    name: test
+    needs:
+      - prerequisites
+      - build_sdk
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    env:
+      PROVIDER_VERSION: ${{ needs.prerequisites.outputs.version }}
+    steps:
+    - name: Checkout Repo
+      uses: actions/checkout@v4
+      with:
+        persist-credentials: false
+    - name: Setup tools
+      uses: ./.github/actions/setup-tools
+      with:
+        tools: pulumictl, pulumicli, ${{ matrix.language }}
+    - name: Download bin
+      uses: ./.github/actions/download-bin
+    - name: Add NuGet source
+      if: matrix.language == 'dotnet'
+      run: dotnet nuget add source ${{ github.workspace }}/nuget
+    - name: Download SDK
+      uses: ./.github/actions/download-sdk
+      with:
+        language: ${{ matrix.language }}
+    - name: Update path
+      run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
+    - name: Install Python deps
+      if: matrix.language == 'python'
+      run: |-
+        pip3 install virtualenv==20.0.23
+        pip3 install pipenv
+    - name: Install dependencies
+      run: make install_${{ matrix.language}}_sdk
+    - name: Install gotestfmt
+      uses: GoTestTools/gotestfmt-action@v2
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+        version: v2.5.0
+    - name: Run tests
+      run: cd examples && go test -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -parallel 4 .
+    strategy:
+      fail-fast: false
+      matrix:
+        language:
+        - dotnet
+        - go
+        - nodejs
+        - python
diff --git a/.github/workflows/resync-build.yml b/.github/workflows/resync-build.yml
new file mode 100644
index 00000000..aa016d07
--- /dev/null
+++ b/.github/workflows/resync-build.yml
@@ -0,0 +1,89 @@
+# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
+
+env:
+  PULUMI_EXTRA_MAPPING_ERROR: true
+  PULUMI_MISSING_MAPPING_ERROR: true
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
+  PULUMI_API: https://api.pulumi-staging.io
+  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
+  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
+  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+  PYPI_USERNAME: __token__
+  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+  TF_APPEND_USER_AGENT: pulumi
+jobs:
+  resync_build:
+    name: resync-build
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout Repo
+      uses: actions/checkout@v4
+      with:
+        # Persist credentials so we can push a new branch.
+        persist-credentials: true
+    - name: Checkout repo
+      uses: actions/checkout@v4
+      with:
+        path: ci-mgmt
+        repository: pulumi/ci-mgmt
+        persist-credentials: false
+    - id: run-url
+      name: Create URL to the run output
+      run:  echo "run-url=https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" >> "$GITHUB_OUTPUT"
+    - name: Setup tools
+      uses: ./.github/actions/setup-tools
+      with:
+        tools: pulumictl, pulumicli, go, nodejs, dotnet, python
+    - name: Sync with ci-mgmt
+      run: cp -r "ci-mgmt/provider-ci/providers/$PROVIDER/repo/." .
+    - name: Remove ci-mgmt directory
+      run: rm -rf ci-mgmt
+    - name: Required entries for gitignore
+      run: |-
+        cat <<- EOF > "$RUNNER_TEMP/gitignore"
+        sdk/java/build
+        sdk/java/.gradle
+        sdk/java/gradle
+        sdk/java/gradlew
+        sdk/java/gradlew.bat
+        EOF
+      shell: bash
+    - name: Adding missing lines to .gitignore
+      run: |
+        comm -23 <(sort "$RUNNER_TEMP/gitignore") <(sort .gitignore) >> .gitignore.temp
+        cat .gitignore.temp >> .gitignore
+        rm .gitignore.temp
+      shell: bash
+    - name: Build
+      run: make build
+    - name: Create PR (no linked issue)
+      uses: peter-evans/create-pull-request@v3.12.0
+      with:
+        author: pulumi-bot <bot@pulumi.com>
+        base: main
+        body: This pull request was generated automatically by the resync-build workflow
+          in this repository.
+        branch: pulumi-bot/resync-${{ github.run_id}}
+        commit-message: Resync build for pulumi-talos
+        committer: pulumi-bot <bot@pulumi.com>
+        labels: impact/no-changelog-required
+        team-reviewers: platform-integrations
+        title: Fix up build for pulumi-talos
+        token: ${{ secrets.PULUMI_BOT_TOKEN }}
+name: Resync build
+on:
+  workflow_dispatch:
+    inputs:
+      automerge:
+        default: false
+        description: Mark created PR for auto-merging?
+        required: true
+        type: boolean
diff --git a/.github/workflows/run-acceptance-tests.yml b/.github/workflows/run-acceptance-tests.yml
new file mode 100644
index 00000000..eacde303
--- /dev/null
+++ b/.github/workflows/run-acceptance-tests.yml
@@ -0,0 +1,185 @@
+# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
+
+name: run-acceptance-tests
+
+on:
+  pull_request:
+    paths-ignore:
+    - CHANGELOG.md
+  repository_dispatch:
+    types:
+    - run-acceptance-tests-command
+
+env:
+  PR_COMMIT_SHA: ${{ github.event.client_payload.pull_request.head.sha }}
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
+  PULUMI_API: https://api.pulumi-staging.io
+  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
+  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
+  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+  PYPI_USERNAME: __token__
+  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+  TF_APPEND_USER_AGENT: pulumi
+
+# This should cancel any previous runs of the same workflow on the same branch which are still running.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  prerequisites:
+    if: github.event_name == 'repository_dispatch' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+    permissions:
+      pull-requests: write
+    uses: ./.github/workflows/prerequisites.yml
+    secrets: inherit
+    with:
+      default_branch: ${{ github.event.repository.default_branch }}
+      is_pr: ${{ github.event_name == 'pull_request' }}
+      is_automated: ${{ github.actor == 'dependabot[bot]' }}
+
+  build_provider:
+    uses: ./.github/workflows/build_provider.yml
+    needs: prerequisites
+    secrets: inherit
+    with:
+      version: ${{ needs.prerequisites.outputs.version }}
+
+  build_sdk:
+    if: github.event_name == 'repository_dispatch' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+    name: build_sdk
+    needs: prerequisites
+    uses: ./.github/workflows/build_sdk.yml
+    secrets: inherit
+    with:
+      version: ${{ needs.prerequisites.outputs.version }}
+
+  comment-notification:
+    if: github.event_name == 'repository_dispatch'
+    name: comment-notification
+    permissions:
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+    - id: run-url
+      name: Create URL to the run output
+      run: echo "run-url=https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" >> "$GITHUB_OUTPUT"
+    - name: Update with Result
+      uses: peter-evans/create-or-update-comment@v1
+      with:
+        body: "Please view the PR build: ${{ steps.run-url.outputs.run-url }}"
+        issue-number: ${{ github.event.client_payload.github.payload.issue.number }}
+        repository: ${{ github.event.client_payload.github.payload.repository.full_name }}
+        token: ${{ secrets.GITHUB_TOKEN }}
+  lint:
+    if: github.event_name == 'repository_dispatch' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+    name: lint
+    uses: ./.github/workflows/lint.yml
+    secrets: inherit
+  sentinel:
+    name: sentinel
+    if: github.event_name == 'repository_dispatch' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+    permissions:
+      statuses: write
+    needs:
+    - test
+    - build_provider
+    - license_check
+    - lint
+    runs-on: ubuntu-latest
+    steps:
+    - uses: guibranco/github-status-action-v2@0849440ec82c5fa69b2377725b9b7852a3977e76
+      with:
+        authToken: ${{secrets.GITHUB_TOKEN}}
+        # Write an explicit status check called "Sentinel" which will only pass if this code really runs.
+        # This should always be a required check for PRs.
+        context: 'Sentinel'
+        description: 'All required checks passed'
+        state: 'success'
+        # Write to the PR commit SHA if it's available as we don't want the merge commit sha,
+        # otherwise use the current SHA for any other type of build.
+        sha: ${{ github.event.pull_request.head.sha || github.sha }}
+
+  test:
+    if: github.event_name == 'repository_dispatch' ||
+      github.event.pull_request.head.repo.full_name == github.repository
+    name: test
+    needs:
+      - prerequisites
+      - build_sdk
+    permissions:
+      contents: read
+      id-token: write
+    runs-on: ubuntu-latest
+    env:
+      PROVIDER_VERSION: ${{ needs.prerequisites.outputs.version }}
+    steps:
+    - name: Checkout Repo
+      uses: actions/checkout@v4
+      with:
+        ref: ${{ env.PR_COMMIT_SHA }}
+        persist-credentials: false
+    - name: Checkout p/examples
+      if: matrix.testTarget == 'pulumiExamples'
+      uses: actions/checkout@v4
+      with:
+        repository: pulumi/examples
+        path: p-examples
+    - name: Setup tools
+      uses: ./.github/actions/setup-tools
+      with:
+        tools: pulumictl, pulumicli, ${{ matrix.language }}
+    - name: Download bin
+      uses: ./.github/actions/download-bin
+    - name: Add NuGet source
+      if: matrix.language == 'dotnet'
+      run: dotnet nuget add source ${{ github.workspace }}/nuget
+    - name: Download SDK
+      uses: ./.github/actions/download-sdk
+      with:
+        language: ${{ matrix.language }}
+    - name: Update path
+      run: echo "${{ github.workspace }}/bin" >> "$GITHUB_PATH"
+    - name: Install Python deps
+      if: matrix.language == 'python'
+      run: |-
+        pip3 install virtualenv==20.0.23
+        pip3 install pipenv
+    - name: Install dependencies
+      run: make install_${{ matrix.language}}_sdk
+    - name: Install gotestfmt
+      uses: GoTestTools/gotestfmt-action@v2
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+        version: v2.5.0
+    - name: Run tests
+      if: matrix.testTarget == 'local'
+      run: cd examples && go test -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -skip TestPulumiExamples -parallel 4 .
+    - name: Run pulumi/examples tests
+      if: matrix.testTarget == 'pulumiExamples'
+      run: cd examples && go test -count=1 -cover -timeout 2h -tags=${{ matrix.language }} -run TestPulumiExamples -parallel 4 .
+    strategy:
+      fail-fast: false
+      matrix:
+        language:
+        - dotnet
+        - go
+        - nodejs
+        - python
+        testTarget: [local]
+  license_check:
+    name: License Check
+    uses: ./.github/workflows/license.yml
+    secrets: inherit
diff --git a/.github/workflows/verify-release.yml b/.github/workflows/verify-release.yml
new file mode 100644
index 00000000..79fc0f64
--- /dev/null
+++ b/.github/workflows/verify-release.yml
@@ -0,0 +1,78 @@
+name: "Verify Release"
+
+on:
+  workflow_dispatch:
+    inputs:
+      providerVersion:
+        description: "The version of the provider to verify"
+        required: true
+        type: string
+      enableMacRunner:
+        description: "Enable the MacOS runner in addition to Linux and Windows. Defaults to 'false'."
+        required: false
+        type: boolean
+      skipGoSdk:
+        description: "Skip the Go SDK verification. Defaults to 'false'. Enable this when verifying a pre-release for which we don't publish the Go SDK (for PRs and the default branch)."
+        required: false
+        type: boolean
+        default: false
+  workflow_call:
+    inputs:
+      providerVersion:
+        description: "The version of the provider to verify"
+        required: true
+        type: string
+      enableMacosRunner:
+        description: "Enable the macos-latest runner in addition to ubuntu-latest and windows-latest. Defaults to 'false'."
+        required: false
+        type: boolean
+        default: false
+      skipGoSdk:
+        description: "Skip the Go SDK verification. Defaults to 'false'. This is used when we're not publishing a Go SDK on the default branch build."
+        required: false
+        type: boolean
+        default: false
+
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+  NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
+  PUBLISH_REPO_PASSWORD: ${{ secrets.OSSRH_PASSWORD }}
+  PUBLISH_REPO_USERNAME: ${{ secrets.OSSRH_USERNAME }}
+  PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
+  PULUMI_API: https://api.pulumi-staging.io
+  PULUMI_GO_DEP_ROOT: ${{ github.workspace }}/..
+  PULUMI_LOCAL_NUGET: ${{ github.workspace }}/nuget
+  PYPI_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+  PYPI_USERNAME: __token__
+  SIGNING_KEY: ${{ secrets.JAVA_SIGNING_KEY }}
+  SIGNING_KEY_ID: ${{ secrets.JAVA_SIGNING_KEY_ID }}
+  SIGNING_PASSWORD: ${{ secrets.JAVA_SIGNING_PASSWORD }}
+  TF_APPEND_USER_AGENT: pulumi
+
+jobs:
+  verify-release:
+    name: verify-release
+    # We don't have any release verification configurations, so we never run this workflow.
+    # Configure your .ci-mgmt.yaml files to include the release verification configurations e.g.
+    # releaseVerification:
+    #   nodejs: path/to/nodejs/project
+    #   python: path/to/python/project
+    #   dotnet: path/to/dotnet/project
+    #   go: path/to/go/project
+    if: false
+    strategy:
+      matrix:
+        # We don't have any release verification configurations, so we only run on Linux to print warnings to help users configure the release verification.
+        runner: ["ubuntu-latest"]
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Setup tools
+        uses: ./.github/actions/setup-tools
+        with:
+          tools: pulumicli, dotnet, go, nodejs, python
diff --git a/.golangci.yml b/.golangci.yml
index 6a03b44d..8d337a1e 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -1,166 +1,35 @@
-# options for analysis running
-run:
-  timeout: 10m
-  issues-exit-code: 1
-  tests: true
-  build-tags: []
-  skip-dirs: []
-  skip-dirs-use-default: true
-  skip-files: []
-  modules-download-mode: readonly
-
-# output configuration options
-output:
-  format: colored-line-number
-  print-issued-lines: true
-  print-linter-name: true
-  uniq-by-line: true
-  path-prefix: ""
-
-# all available settings of specific linters
-linters-settings:
-  dogsled:
-    max-blank-identifiers: 2
-  dupl:
-    threshold: 150
-  errcheck:
-    check-type-assertions: true
-    check-blank: true
-  exhaustive:
-    default-signifies-exhaustive: false
-  funlen:
-    lines: 60
-    statements: 40
-  gci:
-    local-prefixes: github.com/pulumiverse/pulumi-talos
-  gocognit:
-    min-complexity: 30
-  ireturn:
-    allow:
-      - anon
-      - error
-      - empty
-      - stdlib
-  nestif:
-    min-complexity: 5
-  goconst:
-    min-len: 3
-    min-occurrences: 3
-  gocritic:
-    disabled-checks: []
-  gocyclo:
-    min-complexity: 20
-  godot:
-    check-all: false
-  godox:
-    keywords: # default keywords are TODO, BUG, and FIXME, these can be overwritten by this setting
-      - NOTE
-      - OPTIMIZE # marks code that should be optimized before merging
-      - HACK # marks hack-arounds that should be removed before merging
-  gofmt:
-    simplify: true
-  goimports:
-    local-prefixes: github.com/pulumiverse/pulumi-talos
-  golint:
-    min-confidence: 0.8
-  gomnd:
-    settings: {}
-  gomodguard: {}
-  govet:
-    check-shadowing: true
-    enable-all: true
-  depguard:
-    list-type: blacklist
-    include-go-root: false
-  lll:
-    line-length: 200
-    tab-width: 4
-  misspell:
-    locale: US
-    ignore-words: []
-  nakedret:
-    max-func-lines: 30
-  prealloc:
-    simple: true
-    range-loops: true # Report preallocation suggestions on range loops, true by default
-    for-loops: false # Report preallocation suggestions on for loops, false by default
-  nolintlint:
-    allow-unused: false
-    allow-leading-space: false
-    allow-no-explanation: []
-    require-explanation: false
-    require-specific: true
-  rowserrcheck: {}
-  testpackage: {}
-  unparam:
-    check-exported: false
-  unused:
-    check-exported: false
-  whitespace:
-    multi-if: false   # Enforces newlines (or comments) after every multi-line if statement
-    multi-func: false # Enforces newlines (or comments) after every multi-line function signature
-  wsl:
-    strict-append: true
-    allow-assign-and-call: true
-    allow-multiline-assign: true
-    allow-cuddle-declarations: false
-    allow-trailing-comment: false
-    force-case-trailing-whitespace: 0
-    force-err-cuddling: false
-    allow-separated-leading-comment: false
-  gofumpt:
-    extra-rules: false
-  cyclop:
-      # the maximal code complexity to report
-      max-complexity: 20
+# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
 
 linters:
-  enable-all: true
-  disable-all: false
-  fast: false
-  disable:
-    - exhaustruct
-    - exhaustivestruct
-    - forbidigo
-    - funlen
-    - gas
-    - gochecknoglobals
-    - gochecknoinits
-    - godox
-    - goerr113
-    - gomnd
-    - gomoddirectives
-    - ireturn
-    - nestif
-    - nonamedreturns
-    - nosnakecase
-    - paralleltest
-    - tagliatelle
-    - thelper
-    - typecheck
-    - varnamelen
-    - wrapcheck
-    # abandoned linters for which golangci shows the warning that the repo is archived by the owner
-    - interfacer
-    - maligned
-    - golint
-    - scopelint
-    - varcheck
-    - deadcode
-    - structcheck
-    - ifshort
-    # disabled as it seems to be broken - goes into imported libraries and reports issues there
-    - musttag
-
+  enable:
+  - errcheck
+  - gci
+  - goconst
+  - gofmt
+  - gosec
+  - govet
+  - ineffassign
+  - lll
+  - gosimple
+  - staticcheck
+  - misspell
+  - nakedret
+  - revive
+  - unconvert
+  - unused
+  enable-all: false
 issues:
-  exclude: []
-  exclude-rules: []
-  exclude-use-default: false
-  exclude-case-sensitive: false
-  max-issues-per-linter: 10
-  max-same-issues: 3
-  new: false
-
-severity:
-  default-severity: error
-  case-sensitive: false
+  exclude-files:
+  - schema.go
+  - pulumiManifest.go
+run:
+  timeout: 20m
+linters-settings:
+  gci:
+    sections:
+      - standard # Standard section: captures all standard library packages.
+      - blank # Blank section: contains all blank imports.
+      - default # Default section: contains all imports that could not be matched to another section type.
+      - prefix(github.com/pulumi/) # Custom section: groups all imports with the github.com/pulumi/ prefix.
+      - prefix(github.com/pulumiverse/pulumi-talos) # Custom section: local imports
+    custom-order: true
diff --git a/.goreleaser.yml b/.goreleaser.yml
deleted file mode 100644
index 9e7c2bdc..00000000
--- a/.goreleaser.yml
+++ /dev/null
@@ -1,28 +0,0 @@
-archives:
-  - id: archive
-    name_template: '{{ .Binary }}-{{ .Tag }}-{{ .Os }}-{{ .Arch }}'
-before:
-  hooks:
-    - make tfgen
-builds:
-  - binary: pulumi-resource-talos
-    dir: provider
-    env:
-      - CGO_ENABLED=0
-    goarch:
-      - amd64
-      - arm64
-    goos:
-      - darwin
-      - windows
-      - linux
-    ldflags:
-      - -X github.com/pulumiverse/pulumi-talos/provider/pkg/version.Version={{.Tag }}
-    main: ./cmd/pulumi-resource-talos/
-changelog:
-  skip: false
-release:
-  disable: false
-  prerelease: auto
-snapshot:
-  name_template: '{{ .Tag }}-SNAPSHOT'
diff --git a/.upgrade-config.yml b/.upgrade-config.yml
index a9da9716..69cac375 100644
--- a/.upgrade-config.yml
+++ b/.upgrade-config.yml
@@ -1 +1,4 @@
 upstream-provider-name: terraform-provider-talos
+upstream-provider-org: siderolabs
+remove-plugins: true
+pr-reviewers: ringods
diff --git a/CODE-OF-CONDUCT.md b/CODE-OF-CONDUCT.md
new file mode 100644
index 00000000..995e13c0
--- /dev/null
+++ b/CODE-OF-CONDUCT.md
@@ -0,0 +1,80 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, gender identity and expression, level of experience,
+education, socio-economic status, nationality, personal appearance, race,
+religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+* Contribute in a positive and constructive way
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or
+  advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic
+  address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+  
+## Our Community Guidelines
+* Be clear and stay on topic. Communicating with strangers on the Internet can make it hard to convey or read tone, and sarcasm is frequently misunderstood. Try to use clear language, and think about how the other person will receive it.
+* Don’t cross-post the same thing in multiple GitHub Discussion topics or multiple Slack channels. This can make it difficult for people answering your questions and creates "scrollback spam".
+* Public discussion is preferred to private. Avoid using Slack DMs for questions, and instead share them in public Slack channels or GitHub Discussion threads. This allows a larger audience to both share their knowledge as well as learn from your question or issue. If you're having a problem, chances are someone else is having a similar problem. Learning in public is a community contribution.
+* Minimize notifications to other community members. Avoid tagging other community members in Slack messages or Discussion threads, unless you are replying to something specific. Community members are here to help each other, but are not "on call" for support, and we expect everyone to try to minimize "notification fatigue". If your issue is time-sensitive or critical, use methods like support@pulumi.com instead.
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, GitHub Discussions posts, 
+and other contributions that are not aligned to this Code of Conduct, or to ban 
+temporarily or permanently any contributor for other behaviors that they deem 
+inappropriate, threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces (including the Community Slack
+and GitHub Discussions forums) and in public spaces when an individual is representing the 
+project or its community. Examples of representing a project or community include 
+using an official project e-mail address, posting via an official social media account, 
+or acting as an appointed representative at an online or offline event. Representation 
+of a project may be further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team at code-of-conduct@pulumi.com. All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
+
+[homepage]: https://www.contributor-covenant.org
diff --git a/Makefile b/Makefile
index 6a5df85e..c547e433 100644
--- a/Makefile
+++ b/Makefile
@@ -1,114 +1,247 @@
-PROJECT_NAME := Talos Linux
+# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
 
-SHELL            := /bin/bash
-PACK             := talos
-ORG              := pulumiverse
-PROJECT          := github.com/${ORG}/pulumi-${PACK}
-NODE_MODULE_NAME := @pulumiverse/${PACK}
-TF_NAME          := ${PACK}
-PROVIDER_PATH    := provider
-VERSION_PATH     := ${PROVIDER_PATH}/pkg/version.Version
+PACK := talos
+ORG := pulumiverse
+PROJECT := github.com/$(ORG)/pulumi-$(PACK)
+PROVIDER_PATH := provider
+VERSION_PATH := $(PROVIDER_PATH)/pkg/version.Version
+TFGEN := pulumi-tfgen-$(PACK)
+PROVIDER := pulumi-resource-$(PACK)
+JAVA_GEN := pulumi-java-gen
+TESTPARALLELISM := 10
+WORKING_DIR := $(shell pwd)
+PULUMI_PROVIDER_BUILD_PARALLELISM ?=
+PULUMI_CONVERT := 1
+PULUMI_MISSING_DOCS_ERROR := true
 
-TFGEN           := pulumi-tfgen-${PACK}
-PROVIDER        := pulumi-resource-${PACK}
-VERSION         := $(shell pulumictl get version)
+# Override during CI using `make [TARGET] PROVIDER_VERSION=""` or by setting a PROVIDER_VERSION environment variable
+# Local & branch builds will just used this fixed default version unless specified
+PROVIDER_VERSION ?= 0.0.0-alpha.0+dev
+# Use this normalised version everywhere rather than the raw input to ensure consistency.
+VERSION_GENERIC = $(shell pulumictl convert-version --language generic --version "$(PROVIDER_VERSION)")
 
-TESTPARALLELISM := 4
+LDFLAGS_PROJ_VERSION=-X $(PROJECT)/$(VERSION_PATH)=$(VERSION_GENERIC)
+LDFLAGS_UPSTREAM_VERSION=
+LDFLAGS_EXTRAS=
+LDFLAGS=$(LDFLAGS_PROJ_VERSION) $(LDFLAGS_UPSTREAM_VERSION) $(LDFLAGS_EXTRAS)
 
-WORKING_DIR     := $(shell pwd)
+development: install_plugins provider build_sdks install_sdks
 
-OS := $(shell uname)
-EMPTY_TO_AVOID_SED := ""
+build: install_plugins provider build_sdks install_sdks
 
-TAG ?= $(shell git describe --tag --always --dirty)
-ARTIFACTS ?= _out
+build_sdks: build_dotnet build_go build_nodejs build_python 
 
-.PHONY: development provider build_sdks build_nodejs build_dotnet build_go build_python cleanup
+install_go_sdk:
 
-development:: install_plugins provider build_sdks install_sdks cleanup # Build the provider & SDKs for a development environment
+install_java_sdk:
 
-# Required for the codegen action that runs in pulumi/pulumi and pulumi/pulumi-terraform-bridge
-build:: install_plugins provider build_sdks install_sdks
-only_build:: build
+install_python_sdk:
 
-tfgen:: install_plugins
-	(cd provider && go build -o $(WORKING_DIR)/bin/${TFGEN} -ldflags "-X ${PROJECT}/${VERSION_PATH}=${VERSION}" ${PROJECT}/${PROVIDER_PATH}/cmd/${TFGEN})
-	$(WORKING_DIR)/bin/${TFGEN} schema --out provider/cmd/${PROVIDER}
-	(cd provider && VERSION=$(VERSION) go generate cmd/${PROVIDER}/main.go)
+install_sdks: install_dotnet_sdk install_python_sdk install_nodejs_sdk install_java_sdk
 
-provider:: tfgen install_plugins # build the provider binary
-	(cd provider && go build -o $(WORKING_DIR)/bin/${PROVIDER} -ldflags "-X ${PROJECT}/${VERSION_PATH}=${VERSION}" ${PROJECT}/${PROVIDER_PATH}/cmd/${PROVIDER})
+only_build: build
 
-build_sdks:: install_plugins provider build_nodejs build_python build_go build_dotnet # build all the sdks
-
-build_nodejs:: VERSION := $(shell pulumictl get version --language javascript)
-build_nodejs:: install_plugins tfgen # build the node sdk
-	$(WORKING_DIR)/bin/$(TFGEN) nodejs --overlays provider/overlays/nodejs --out sdk/nodejs/
+build_dotnet: export PULUMI_HOME := $(WORKING_DIR)/.pulumi
+build_dotnet: export PATH := $(WORKING_DIR)/.pulumi/bin:$(PATH)
+build_dotnet: export PULUMI_CONVERT_EXAMPLES_CACHE_DIR := $(WORKING_DIR)/.pulumi/examples-cache
+build_dotnet: upstream
+	PULUMI_CONVERT=$(PULUMI_CONVERT) PULUMI_DISABLE_AUTOMATIC_PLUGIN_ACQUISITION=$(PULUMI_CONVERT) $(WORKING_DIR)/bin/$(TFGEN) dotnet --out sdk/dotnet/
+	cd sdk/dotnet/ && \
+		printf "module fake_dotnet_module // Exclude this directory from Go tools\n\ngo 1.17\n" > go.mod && \
+		echo "$(VERSION_GENERIC)" >version.txt && \
+		dotnet build
+
+build_go: export PULUMI_HOME := $(WORKING_DIR)/.pulumi
+build_go: export PATH := $(WORKING_DIR)/.pulumi/bin:$(PATH)
+build_go: export PULUMI_CONVERT_EXAMPLES_CACHE_DIR := $(WORKING_DIR)/.pulumi/examples-cache
+build_go: upstream
+	PULUMI_CONVERT=$(PULUMI_CONVERT) PULUMI_DISABLE_AUTOMATIC_PLUGIN_ACQUISITION=$(PULUMI_CONVERT) $(WORKING_DIR)/bin/$(TFGEN) go --out sdk/go/
+	cd sdk && go list "$$(grep -e "^module" go.mod | cut -d ' ' -f 2)/go/..." | xargs -I {} bash -c 'go build {} && go clean -i {}'
+
+build_java: PACKAGE_VERSION := $(VERSION_GENERIC)
+build_java: export PULUMI_HOME := $(WORKING_DIR)/.pulumi
+build_java: export PATH := $(WORKING_DIR)/.pulumi/bin:$(PATH)
+build_java: export PULUMI_CONVERT_EXAMPLES_CACHE_DIR := $(WORKING_DIR)/.pulumi/examples-cache
+build_java: bin/pulumi-java-gen upstream
+	$(WORKING_DIR)/bin/$(JAVA_GEN) generate --schema provider/cmd/$(PROVIDER)/schema.json --out sdk/java  --build gradle-nexus
+	cd sdk/java/ && \
+		printf "module fake_java_module // Exclude this directory from Go tools\n\ngo 1.17\n" > go.mod && \
+		gradle --console=plain build && \
+		gradle --console=plain javadoc
+
+build_nodejs: export PULUMI_HOME := $(WORKING_DIR)/.pulumi
+build_nodejs: export PATH := $(WORKING_DIR)/.pulumi/bin:$(PATH)
+build_nodejs: export PULUMI_CONVERT_EXAMPLES_CACHE_DIR := $(WORKING_DIR)/.pulumi/examples-cache
+build_nodejs: upstream
+	PULUMI_CONVERT=$(PULUMI_CONVERT) PULUMI_DISABLE_AUTOMATIC_PLUGIN_ACQUISITION=$(PULUMI_CONVERT) $(WORKING_DIR)/bin/$(TFGEN) nodejs --out sdk/nodejs/
 	cd sdk/nodejs/ && \
-        yarn install && \
-        yarn run tsc && \
-        cp ../../README.md ../../LICENSE package.json yarn.lock ./bin/ && \
-		sed -i.bak -e "s/\$${VERSION}/$(VERSION)/g" ./bin/package.json
-
-build_python:: PYPI_VERSION := $(shell pulumictl get version --language python)
-build_python:: install_plugins tfgen # build the python sdk
-	$(WORKING_DIR)/bin/$(TFGEN) python --overlays provider/overlays/python --out sdk/python/
+		printf "module fake_nodejs_module // Exclude this directory from Go tools\n\ngo 1.17\n" > go.mod && \
+		yarn install && \
+		yarn run tsc && \
+		cp ../../README.md ../../LICENSE* package.json yarn.lock ./bin/
+
+build_python: export PULUMI_HOME := $(WORKING_DIR)/.pulumi
+build_python: export PATH := $(WORKING_DIR)/.pulumi/bin:$(PATH)
+build_python: export PULUMI_CONVERT_EXAMPLES_CACHE_DIR := $(WORKING_DIR)/.pulumi/examples-cache
+build_python: upstream
+	rm -rf sdk/python/
+	PULUMI_CONVERT=$(PULUMI_CONVERT) PULUMI_DISABLE_AUTOMATIC_PLUGIN_ACQUISITION=$(PULUMI_CONVERT) $(WORKING_DIR)/bin/$(TFGEN) python --out sdk/python/
 	cd sdk/python/ && \
-        cp ../../README.md . && \
-        python3 setup.py clean --all 2>/dev/null && \
-        rm -rf ./bin/ ../python.bin/ && cp -R . ../python.bin && mv ../python.bin ./bin && \
-        sed -i.bak -e 's/^VERSION = .*/VERSION = "$(PYPI_VERSION)"/g' -e 's/^PLUGIN_VERSION = .*/PLUGIN_VERSION = "$(VERSION)"/g' ./bin/setup.py && \
-        rm ./bin/setup.py.bak && \
-        cd ./bin && python3 setup.py build sdist
-
-build_dotnet:: DOTNET_VERSION := $(shell pulumictl get version --language dotnet)
-build_dotnet:: install_plugins tfgen # build the dotnet sdk
-	pulumictl get version --language dotnet
-	$(WORKING_DIR)/bin/$(TFGEN) dotnet --overlays provider/overlays/dotnet --out sdk/dotnet/
-	cd sdk/dotnet/ && \
-		echo "${DOTNET_VERSION}" >version.txt && \
-        dotnet build /p:Version=${DOTNET_VERSION}
-
-build_go:: install_plugins tfgen # build the go sdk
-	$(WORKING_DIR)/bin/$(TFGEN) go --overlays provider/overlays/go --out sdk/go/
-
-lint_provider:: provider # lint the provider code
-	cd provider && golangci-lint run -c ../.golangci.yml
+		printf "module fake_python_module // Exclude this directory from Go tools\n\ngo 1.17\n" > go.mod && \
+		cp ../../README.md . && \
+		rm -rf ./bin/ ../python.bin/ && cp -R . ../python.bin && mv ../python.bin ./bin && \
+		rm ./bin/go.mod && \
+		python3 -m venv venv && \
+		./venv/bin/python -m pip install build==1.2.1 && \
+		cd ./bin && \
+		../venv/bin/python -m build .
+
+clean:
+	rm -rf sdk/{dotnet,nodejs,go,python}
 
-cleanup:: # cleans up the temporary directory
+cleanup:
 	rm -r $(WORKING_DIR)/bin
-	rm -f provider/cmd/${PROVIDER}/schema.go
+	rm -f provider/cmd/$(PROVIDER)/schema.go
 
-help::
+help:
 	@grep '^[^.#]\+:\s\+.*#' Makefile | \
- 	sed "s/\(.\+\):\s*\(.*\) #\s*\(.*\)/`printf "\033[93m"`\1`printf "\033[0m"`	\3 [\2]/" | \
- 	expand -t20
-
-clean::
-	rm -rf sdk/{dotnet,nodejs,go,python}
-
-install_plugins::
+	sed "s/\(.\+\):\s*\(.*\) #\s*\(.*\)/`printf "\033[93m"`\1`printf "\033[0m"`	\3 [\2]/" | \
+	expand -t20
 
-install_dotnet_sdk::
+install_dotnet_sdk:
 	mkdir -p $(WORKING_DIR)/nuget
-	find . -name '*.nupkg' -print -exec cp -p {} ${WORKING_DIR}/nuget \;
-
-install_python_sdk::
-
-install_go_sdk::
+	find . -name '*.nupkg' -print -exec cp -p {} $(WORKING_DIR)/nuget \;
 
-install_nodejs_sdk::
+install_nodejs_sdk:
 	yarn link --cwd $(WORKING_DIR)/sdk/nodejs/bin
 
-install_sdks:: install_dotnet_sdk install_python_sdk install_nodejs_sdk
-
-test::
-	cd examples && go test -v -tags=all -parallel ${TESTPARALLELISM} -timeout 2h
-
-.PHONY: check-dirty
-check-dirty: tfgen build_sdks ## Verifies that source tree is not dirty
-	@if test -n "`git status --porcelain`"; then echo "Source tree is dirty"; git status; exit 1 ; fi
-
-release-notes:
-	mkdir -p $(ARTIFACTS)
-	@ARTIFACTS=$(ARTIFACTS) ./hack/release.sh $@ $(ARTIFACTS)/RELEASE_NOTES.md $(TAG)
+install_plugins: export PULUMI_HOME := $(WORKING_DIR)/.pulumi
+install_plugins: export PATH := $(WORKING_DIR)/.pulumi/bin:$(PATH)
+install_plugins: .pulumi/bin/pulumi
+	.pulumi/bin/pulumi plugin install converter terraform 1.0.19
+
+lint_provider: provider
+	cd provider && golangci-lint run --path-prefix provider -c ../.golangci.yml
+
+# `lint_provider.fix` is a utility target meant to be run manually
+# that will run the linter and fix errors when possible.
+lint_provider.fix:
+	cd provider && golangci-lint run --path-prefix provider -c ../.golangci.yml --fix
+
+# `make provider_no_deps` builds the provider binary directly, without ensuring that
+# `cmd/pulumi-resource-talos/schema.json` is valid and up to date.
+# To create a release ready binary, you should use `make provider`.
+provider_no_deps:
+	(cd provider && go build $(PULUMI_PROVIDER_BUILD_PARALLELISM) -o $(WORKING_DIR)/bin/$(PROVIDER) -ldflags "$(LDFLAGS)" $(PROJECT)/$(PROVIDER_PATH)/cmd/$(PROVIDER))
+
+provider: tfgen provider_no_deps
+
+test: export PATH := $(WORKING_DIR)/bin:$(PATH)
+test:
+	cd examples && go test -v -tags=all -parallel $(TESTPARALLELISM) -timeout 2h
+
+test_provider:
+	@echo ""
+	@echo "== test_provider ==================================================================="
+	@echo ""
+	cd provider && go test -v -short ./... -parallel $(TESTPARALLELISM)
+
+tfgen: install_plugins upstream tfgen_no_deps
+
+tfgen_no_deps: export PULUMI_HOME := $(WORKING_DIR)/.pulumi
+tfgen_no_deps: export PATH := $(WORKING_DIR)/.pulumi/bin:$(PATH)
+tfgen_no_deps: export PULUMI_CONVERT := $(PULUMI_CONVERT)
+tfgen_no_deps: export PULUMI_CONVERT_EXAMPLES_CACHE_DIR := $(WORKING_DIR)/.pulumi/examples-cache
+tfgen_no_deps: export PULUMI_DISABLE_AUTOMATIC_PLUGIN_ACQUISITION := $(PULUMI_CONVERT)
+tfgen_no_deps: export PULUMI_MISSING_DOCS_ERROR := $(PULUMI_MISSING_DOCS_ERROR)
+tfgen_no_deps: tfgen_build_only
+	$(WORKING_DIR)/bin/$(TFGEN) schema --out provider/cmd/$(PROVIDER)
+	(cd provider && VERSION=$(VERSION_GENERIC) go generate cmd/$(PROVIDER)/main.go)
+
+tfgen_build_only:
+	(cd provider && go build $(PULUMI_PROVIDER_BUILD_PARALLELISM) -o $(WORKING_DIR)/bin/$(TFGEN) -ldflags "$(LDFLAGS_PROJ_VERSION) $(LDFLAGS_EXTRAS)" $(PROJECT)/$(PROVIDER_PATH)/cmd/$(TFGEN))
+
+upstream:
+ifneq ("$(wildcard upstream)","")
+	./upstream.sh init
+endif
+
+bin/pulumi-java-gen: .pulumi-java-gen.version
+	pulumictl download-binary -n pulumi-language-java -v v$(shell cat .pulumi-java-gen.version) -r pulumi/pulumi-java
+
+# To make an immediately observable change to .ci-mgmt.yaml:
+#
+# - Edit .ci-mgmt.yaml
+# - Run make ci-mgmt to apply the change locally.
+#
+ci-mgmt: .ci-mgmt.yaml
+	go run github.com/pulumi/ci-mgmt/provider-ci@master generate \
+		--name $(ORG)/pulumi-$(PACK) \
+		--out . \
+		--template external-bridged-provider \
+		--config $<
+
+# Because some codegen depends on the version of the CLI used, we install a local CLI
+# version pinned to the same version as `provider/go.mod`.
+#
+# This logic compares the version of .pulumi/bin/pulumi already installed. If it matches
+# the desired version, we just print. Otherwise we (re)install pulumi at the desired
+# version.
+.pulumi/bin/pulumi: .pulumi/version
+	@if [ -x .pulumi/bin/pulumi ] && [ "v$$(cat .pulumi/version)" = "$$(.pulumi/bin/pulumi version)" ]; then \
+		echo "pulumi/bin/pulumi version: v$$(cat .pulumi/version)"; \
+	else \
+		curl -fsSL https://get.pulumi.com | \
+			HOME=$(WORKING_DIR) sh -s -- --version "$$(cat .pulumi/version)"; \
+	fi
+
+# Compute the version of Pulumi to use by inspecting the Go dependencies of the provider.
+.pulumi/version: provider/go.mod
+	@mkdir -p .pulumi
+	@cd provider && go list -f "{{slice .Version 1}}" -m github.com/pulumi/pulumi/pkg/v3 | tee ../$@
+
+# Start debug server for tfgen
+debug_tfgen:
+	dlv  --listen=:2345 --headless=true --api-version=2  exec $(WORKING_DIR)/bin/$(TFGEN) -- schema --out provider/cmd/$(PROVIDER)
+
+.PHONY: development build build_sdks install_go_sdk install_java_sdk install_python_sdk install_sdks only_build build_dotnet build_go build_java build_nodejs build_python clean cleanup help install_dotnet_sdk install_nodejs_sdk install_plugins lint_provider provider provider_no_deps test tfgen upstream ci-mgmt test_provider debug_tfgen tfgen_build_only
+
+# Provider cross-platform build & packaging
+
+# These targets assume that the schema-embed.json exists - it's generated by tfgen.
+# We disable CGO to ensure that the binary is statically linked.
+bin/linux-amd64/$(PROVIDER): TARGET := linux-amd64
+bin/linux-arm64/$(PROVIDER): TARGET := linux-arm64
+bin/darwin-amd64/$(PROVIDER): TARGET := darwin-amd64
+bin/darwin-arm64/$(PROVIDER): TARGET := darwin-arm64
+bin/windows-amd64/$(PROVIDER).exe: TARGET := windows-amd64
+bin/%/$(PROVIDER) bin/%/$(PROVIDER).exe:
+	@# check the TARGET is set
+	test $(TARGET)
+	cd provider && \
+		export GOOS=$$(echo "$(TARGET)" | cut -d "-" -f 1) && \
+		export GOARCH=$$(echo "$(TARGET)" | cut -d "-" -f 2) && \
+		export CGO_ENABLED=0 && \
+		go build -o "${WORKING_DIR}/$@" $(PULUMI_PROVIDER_BUILD_PARALLELISM) -ldflags "$(LDFLAGS)" "$(PROJECT)/$(PROVIDER_PATH)/cmd/$(PROVIDER)"
+
+bin/$(PROVIDER)-v$(VERSION_GENERIC)-linux-amd64.tar.gz: bin/linux-amd64/$(PROVIDER)
+bin/$(PROVIDER)-v$(VERSION_GENERIC)-linux-arm64.tar.gz: bin/linux-arm64/$(PROVIDER)
+bin/$(PROVIDER)-v$(VERSION_GENERIC)-darwin-amd64.tar.gz: bin/darwin-amd64/$(PROVIDER)
+bin/$(PROVIDER)-v$(VERSION_GENERIC)-darwin-arm64.tar.gz: bin/darwin-arm64/$(PROVIDER)
+bin/$(PROVIDER)-v$(VERSION_GENERIC)-windows-amd64.tar.gz: bin/windows-amd64/$(PROVIDER).exe
+bin/$(PROVIDER)-v$(VERSION_GENERIC)-%.tar.gz:
+	@mkdir -p dist
+	@# $< is the last dependency (the binary path from above) e.g. bin/linux-amd64/pulumi-resource-xyz
+	@# $@ is the current target e.g. bin/pulumi-resource-xyz-v1.2.3-linux-amd64.tar.gz
+	tar --gzip -cf $@ README.md LICENSE -C $$(dirname $<) .
+
+provider_dist-linux-amd64: bin/$(PROVIDER)-v$(VERSION_GENERIC)-linux-amd64.tar.gz
+provider_dist-linux-arm64: bin/$(PROVIDER)-v$(VERSION_GENERIC)-linux-arm64.tar.gz
+provider_dist-darwin-amd64: bin/$(PROVIDER)-v$(VERSION_GENERIC)-darwin-amd64.tar.gz
+provider_dist-darwin-arm64: bin/$(PROVIDER)-v$(VERSION_GENERIC)-darwin-arm64.tar.gz
+provider_dist-windows-amd64: bin/$(PROVIDER)-v$(VERSION_GENERIC)-windows-amd64.tar.gz
+provider_dist: provider_dist-linux-amd64 provider_dist-linux-arm64 provider_dist-darwin-amd64 provider_dist-darwin-arm64 provider_dist-windows-amd64
+.PHONY: provider_dist-linux-amd64 provider_dist-linux-arm64 provider_dist-darwin-amd64 provider_dist-darwin-arm64 provider_dist-windows-amd64 provider_dist
+
+# Permit providers to extend the Makefile with provider-specific Make includes.
+include $(wildcard .mk/*.mk)
diff --git a/devbox.json b/devbox.json
new file mode 100644
index 00000000..8b0c864a
--- /dev/null
+++ b/devbox.json
@@ -0,0 +1,22 @@
+{
+  "packages": [
+    "yarn@latest",
+    "pulumictl@latest",
+    "go@1.22.",
+    "nodejs@20.",
+    "python3@3.11.8",
+    "dotnet-sdk@6.0.",
+    "gradle_7@7.6",
+    "curl@8"
+  ],
+  "shell": {
+    "init_hook": [
+      "export PATH=\"$(pwd)/bin/:$PATH\""
+    ],
+    "scripts": {
+      "test": [
+        "echo \"Error: no test specified\" && exit 1"
+      ]
+    }
+  }
+}
diff --git a/devbox.lock b/devbox.lock
new file mode 100644
index 00000000..0967ef42
--- /dev/null
+++ b/devbox.lock
@@ -0,0 +1 @@
+{}
diff --git a/provider/cmd/pulumi-resource-talos/schema.json b/provider/cmd/pulumi-resource-talos/schema.json
index 63d32493..21a5edc1 100644
--- a/provider/cmd/pulumi-resource-talos/schema.json
+++ b/provider/cmd/pulumi-resource-talos/schema.json
@@ -50,7 +50,9 @@
             },
             "readme": "\u003e This provider is a derived work of the [Terraform Provider](https://github.com/siderolabs/terraform-provider-talos)\n\u003e distributed under [MPL 2.0](https://www.mozilla.org/en-US/MPL/2.0/). If you encounter a bug or missing feature,\n\u003e first check the [`pulumi-talos` repo](https://github.com/pulumiverse/pulumi-talos/issues); however, if that doesn't turn up anything,\n\u003e please consult the source [`terraform-provider-talos` repo](https://github.com/siderolabs/terraform-provider-talos/issues).",
             "compatibility": "tfbridge20",
-            "pyproject": {}
+            "pyproject": {
+                "enabled": true
+            }
         }
     },
     "config": {},
@@ -1206,7 +1208,7 @@
             }
         },
         "talos:machine/secrets:Secrets": {
-            "description": "Generate machine secrets for Talos cluster.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as talos from \"@pulumiverse/talos\";\n\nconst machineSecrets = new talos.machine.Secrets(\"machineSecrets\", {});\n```\n```python\nimport pulumi\nimport pulumiverse_talos as talos\n\nmachine_secrets = talos.machine.Secrets(\"machineSecrets\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Talos = Pulumiverse.Talos;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var machineSecrets = new Talos.Machine.Secrets(\"machineSecrets\");\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n\t\"github.com/pulumiverse/pulumi-talos/sdk/go/talos/machine\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := machine.NewSecrets(ctx, \"machineSecrets\", nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.talos.machine.Secrets;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var machineSecrets = new Secrets(\"machineSecrets\");\n\n    }\n}\n```\n```yaml\nresources:\n  machineSecrets:\n    type: talos:machine:Secrets\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nterraform\n\nmachine secrets can be imported from an existing secrets file\n\n```sh\n$ pulumi import talos:machine/secrets:Secrets this \u003cpath-to-secrets.yaml\u003e\n```\n\n",
+            "description": "Generate machine secrets for Talos cluster.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as talos from \"@pulumiverse/talos\";\n\nconst machineSecrets = new talos.machine.Secrets(\"machine_secrets\", {});\n```\n```python\nimport pulumi\nimport pulumiverse_talos as talos\n\nmachine_secrets = talos.machine.Secrets(\"machine_secrets\")\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Talos = Pulumiverse.Talos;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var machineSecrets = new Talos.Machine.Secrets(\"machine_secrets\");\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n\t\"github.com/pulumiverse/pulumi-talos/sdk/go/talos/machine\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\t_, err := machine.NewSecrets(ctx, \"machine_secrets\", nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.talos.machine.Secrets;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var machineSecrets = new Secrets(\"machineSecrets\");\n\n    }\n}\n```\n```yaml\nresources:\n  machineSecrets:\n    type: talos:machine:Secrets\n    name: machine_secrets\n```\n\u003c!--End PulumiCodeChooser --\u003e\n\n## Import\n\nterraform\n\nmachine secrets can be imported from an existing secrets file\n\n```sh\n$ pulumi import talos:machine/secrets:Secrets this \u003cpath-to-secrets.yaml\u003e\n```\n\n",
             "properties": {
                 "clientConfiguration": {
                     "$ref": "#/types/talos:machine/generated:ClientConfiguration",
@@ -1254,7 +1256,7 @@
     },
     "functions": {
         "talos:client/getConfiguration:getConfiguration": {
-            "description": "Generate client configuration for a Talos cluster\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as talos from \"@pulumi/talos\";\nimport * as talos from \"@pulumiverse/talos\";\n\nconst thisSecrets = new talos.machine.Secrets(\"thisSecrets\", {});\nconst thisConfiguration = talos.client.getConfigurationOutput({\n    clusterName: \"example-cluster\",\n    clientConfiguration: thisSecrets.clientConfiguration,\n    nodes: [\"10.5.0.2\"],\n});\n```\n```python\nimport pulumi\nimport pulumi_talos as talos\nimport pulumiverse_talos as talos\n\nthis_secrets = talos.machine.Secrets(\"thisSecrets\")\nthis_configuration = talos.client.get_configuration_output(cluster_name=\"example-cluster\",\n    client_configuration=this_secrets.client_configuration,\n    nodes=[\"10.5.0.2\"])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Talos = Pulumi.Talos;\nusing Talos = Pulumiverse.Talos;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var thisSecrets = new Talos.Machine.Secrets(\"thisSecrets\");\n\n    var thisConfiguration = Talos.Client.GetConfiguration.Invoke(new()\n    {\n        ClusterName = \"example-cluster\",\n        ClientConfiguration = thisSecrets.ClientConfiguration,\n        Nodes = new[]\n        {\n            \"10.5.0.2\",\n        },\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n\t\"github.com/pulumiverse/pulumi-talos/sdk/go/talos/client\"\n\t\"github.com/pulumiverse/pulumi-talos/sdk/go/talos/machine\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tthisSecrets, err := machine.NewSecrets(ctx, \"thisSecrets\", nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_ = client.GetConfigurationOutput(ctx, client.GetConfigurationOutputArgs{\n\t\t\tClusterName:         pulumi.String(\"example-cluster\"),\n\t\t\tClientConfiguration: thisSecrets.ClientConfiguration,\n\t\t\tNodes: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"10.5.0.2\"),\n\t\t\t},\n\t\t}, nil)\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.talos.machine.Secrets;\nimport com.pulumi.talos.client.ClientFunctions;\nimport com.pulumi.talos.client.inputs.GetConfigurationArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var thisSecrets = new Secrets(\"thisSecrets\");\n\n        final var thisConfiguration = ClientFunctions.getConfiguration(GetConfigurationArgs.builder()\n            .clusterName(\"example-cluster\")\n            .clientConfiguration(thisSecrets.clientConfiguration())\n            .nodes(\"10.5.0.2\")\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  thisSecrets:\n    type: talos:machine:Secrets\nvariables:\n  thisConfiguration:\n    fn::invoke:\n      Function: talos:client:getConfiguration\n      Arguments:\n        clusterName: example-cluster\n        clientConfiguration: ${thisSecrets.clientConfiguration}\n        nodes:\n          - 10.5.0.2\n```\n\u003c!--End PulumiCodeChooser --\u003e\n",
+            "description": "Generate client configuration for a Talos cluster\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as talos from \"@pulumi/talos\";\nimport * as talos from \"@pulumiverse/talos\";\n\nconst thisSecrets = new talos.machine.Secrets(\"this\", {});\nconst this = talos.client.getConfigurationOutput({\n    clusterName: \"example-cluster\",\n    clientConfiguration: thisSecrets.clientConfiguration,\n    nodes: [\"10.5.0.2\"],\n});\n```\n```python\nimport pulumi\nimport pulumi_talos as talos\nimport pulumiverse_talos as talos\n\nthis_secrets = talos.machine.Secrets(\"this\")\nthis = talos.client.get_configuration_output(cluster_name=\"example-cluster\",\n    client_configuration=this_secrets.client_configuration,\n    nodes=[\"10.5.0.2\"])\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Talos = Pulumi.Talos;\nusing Talos = Pulumiverse.Talos;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var thisSecrets = new Talos.Machine.Secrets(\"this\");\n\n    var @this = Talos.Client.GetConfiguration.Invoke(new()\n    {\n        ClusterName = \"example-cluster\",\n        ClientConfiguration = thisSecrets.ClientConfiguration,\n        Nodes = new[]\n        {\n            \"10.5.0.2\",\n        },\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n\t\"github.com/pulumiverse/pulumi-talos/sdk/go/talos/client\"\n\t\"github.com/pulumiverse/pulumi-talos/sdk/go/talos/machine\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tthisSecrets, err := machine.NewSecrets(ctx, \"this\", nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_ = client.GetConfigurationOutput(ctx, client.GetConfigurationOutputArgs{\n\t\t\tClusterName:         pulumi.String(\"example-cluster\"),\n\t\t\tClientConfiguration: thisSecrets.ClientConfiguration,\n\t\t\tNodes: pulumi.StringArray{\n\t\t\t\tpulumi.String(\"10.5.0.2\"),\n\t\t\t},\n\t\t}, nil)\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.talos.machine.Secrets;\nimport com.pulumi.talos.client.ClientFunctions;\nimport com.pulumi.talos.client.inputs.GetConfigurationArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var thisSecrets = new Secrets(\"thisSecrets\");\n\n        final var this = ClientFunctions.getConfiguration(GetConfigurationArgs.builder()\n            .clusterName(\"example-cluster\")\n            .clientConfiguration(thisSecrets.clientConfiguration())\n            .nodes(\"10.5.0.2\")\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  thisSecrets:\n    type: talos:machine:Secrets\n    name: this\nvariables:\n  this:\n    fn::invoke:\n      Function: talos:client:getConfiguration\n      Arguments:\n        clusterName: example-cluster\n        clientConfiguration: ${thisSecrets.clientConfiguration}\n        nodes:\n          - 10.5.0.2\n```\n\u003c!--End PulumiCodeChooser --\u003e\n",
             "inputs": {
                 "description": "A collection of arguments for invoking getConfiguration.\n",
                 "properties": {
@@ -1295,40 +1297,40 @@
                         "description": "The client configuration data\n"
                     },
                     "clusterName": {
-                        "type": "string",
-                        "description": "The name of the cluster in the generated config\n"
+                        "description": "The name of the cluster in the generated config\n",
+                        "type": "string"
                     },
                     "endpoints": {
-                        "type": "array",
+                        "description": "endpoints to set in the generated config\n",
                         "items": {
                             "type": "string"
                         },
-                        "description": "endpoints to set in the generated config\n"
+                        "type": "array"
                     },
                     "id": {
-                        "type": "string",
-                        "description": "The ID of this resource\n"
+                        "description": "The ID of this resource\n",
+                        "type": "string"
                     },
                     "nodes": {
-                        "type": "array",
+                        "description": "nodes to set in the generated config\n",
                         "items": {
                             "type": "string"
                         },
-                        "description": "nodes to set in the generated config\n"
+                        "type": "array"
                     },
                     "talosConfig": {
-                        "type": "string",
                         "description": "The generated client configuration\n",
-                        "secret": true
+                        "secret": true,
+                        "type": "string"
                     }
                 },
-                "type": "object",
                 "required": [
                     "clientConfiguration",
                     "clusterName",
                     "id",
                     "talosConfig"
-                ]
+                ],
+                "type": "object"
             }
         },
         "talos:cluster/getHealth:getHealth": {
@@ -1380,41 +1382,41 @@
                         "description": "The client configuration data\n"
                     },
                     "controlPlaneNodes": {
-                        "type": "array",
+                        "description": "List of control plane nodes to check for health.\n",
                         "items": {
                             "type": "string"
                         },
-                        "description": "List of control plane nodes to check for health.\n"
+                        "type": "array"
                     },
                     "endpoints": {
-                        "type": "array",
+                        "description": "endpoints to use for the health check client. Use at least one control plane endpoint.\n",
                         "items": {
                             "type": "string"
                         },
-                        "description": "endpoints to use for the health check client. Use at least one control plane endpoint.\n"
+                        "type": "array"
                     },
                     "id": {
-                        "type": "string",
-                        "description": "The ID of this resource.\n"
+                        "description": "The ID of this resource.\n",
+                        "type": "string"
                     },
                     "timeouts": {
                         "$ref": "#/types/talos:cluster/getHealthTimeouts:getHealthTimeouts"
                     },
                     "workerNodes": {
-                        "type": "array",
+                        "description": "List of worker nodes to check for health.\n",
                         "items": {
                             "type": "string"
                         },
-                        "description": "List of worker nodes to check for health.\n"
+                        "type": "array"
                     }
                 },
-                "type": "object",
                 "required": [
                     "clientConfiguration",
                     "controlPlaneNodes",
                     "endpoints",
                     "id"
-                ]
+                ],
+                "type": "object"
             }
         },
         "talos:cluster/getKubeconfig:getKubeconfig": {
@@ -1457,36 +1459,35 @@
                         "description": "The client configuration data\n"
                     },
                     "endpoint": {
-                        "type": "string",
-                        "description": "endpoint to use for the talosclient. If not set, the node value will be used\n"
+                        "description": "endpoint to use for the talosclient. If not set, the node value will be used\n",
+                        "type": "string"
                     },
                     "id": {
-                        "type": "string",
-                        "description": "The ID of this resource.\n"
+                        "description": "The ID of this resource.\n",
+                        "type": "string"
                     },
                     "kubeconfigRaw": {
-                        "type": "string",
                         "description": "The raw kubeconfig\n",
-                        "secret": true
+                        "secret": true,
+                        "type": "string"
                     },
                     "kubernetesClientConfiguration": {
                         "$ref": "#/types/talos:cluster/getKubeconfigKubernetesClientConfiguration:getKubeconfigKubernetesClientConfiguration",
                         "description": "The kubernetes client configuration\n"
                     },
                     "node": {
-                        "type": "string",
-                        "description": "controlplane node to retrieve the kubeconfig from\n"
+                        "description": "controlplane node to retrieve the kubeconfig from\n",
+                        "type": "string"
                     },
                     "timeouts": {
                         "$ref": "#/types/talos:cluster/getKubeconfigTimeouts:getKubeconfigTimeouts"
                     },
                     "wait": {
-                        "type": "boolean",
+                        "deprecationMessage": "This attribute is deprecated and no-op. Will be removed in a future version. Use talos.cluster.getHealth instead.",
                         "description": "Wait for the kubernetes api to be available\n",
-                        "deprecationMessage": "This attribute is deprecated and no-op. Will be removed in a future version. Use talos.cluster.getHealth instead."
+                        "type": "boolean"
                     }
                 },
-                "type": "object",
                 "required": [
                     "clientConfiguration",
                     "endpoint",
@@ -1494,11 +1495,12 @@
                     "kubeconfigRaw",
                     "kubernetesClientConfiguration",
                     "node"
-                ]
+                ],
+                "type": "object"
             }
         },
         "talos:machine/getConfiguration:getConfiguration": {
-            "description": "Generate a machine configuration for a node type\n\n\u003e **Note:** It is recommended to set the optional `talos_version` attribute. Otherwise when using a new version of the provider with a new major version of the Talos SDK, new machineconfig features will be enabled by default which could cause unexpected behavior.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as talos from \"@pulumi/talos\";\nimport * as talos from \"@pulumiverse/talos\";\n\nconst thisSecrets = new talos.machine.Secrets(\"thisSecrets\", {});\nconst thisConfiguration = talos.machine.getConfigurationOutput({\n    clusterName: \"example-cluster\",\n    machineType: \"controlplane\",\n    clusterEndpoint: \"https://cluster.local:6443\",\n    machineSecrets: thisSecrets.machineSecrets,\n});\n```\n```python\nimport pulumi\nimport pulumi_talos as talos\nimport pulumiverse_talos as talos\n\nthis_secrets = talos.machine.Secrets(\"thisSecrets\")\nthis_configuration = talos.machine.get_configuration_output(cluster_name=\"example-cluster\",\n    machine_type=\"controlplane\",\n    cluster_endpoint=\"https://cluster.local:6443\",\n    machine_secrets=this_secrets.machine_secrets)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Talos = Pulumi.Talos;\nusing Talos = Pulumiverse.Talos;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var thisSecrets = new Talos.Machine.Secrets(\"thisSecrets\");\n\n    var thisConfiguration = Talos.Machine.GetConfiguration.Invoke(new()\n    {\n        ClusterName = \"example-cluster\",\n        MachineType = \"controlplane\",\n        ClusterEndpoint = \"https://cluster.local:6443\",\n        MachineSecrets = thisSecrets.MachineSecrets,\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n\t\"github.com/pulumiverse/pulumi-talos/sdk/go/talos/machine\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tthisSecrets, err := machine.NewSecrets(ctx, \"thisSecrets\", nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_ = machine.GetConfigurationOutput(ctx, machine.GetConfigurationOutputArgs{\n\t\t\tClusterName:     pulumi.String(\"example-cluster\"),\n\t\t\tMachineType:     pulumi.String(\"controlplane\"),\n\t\t\tClusterEndpoint: pulumi.String(\"https://cluster.local:6443\"),\n\t\t\tMachineSecrets:  thisSecrets.MachineSecrets,\n\t\t}, nil)\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.talos.machine.Secrets;\nimport com.pulumi.talos.machine.MachineFunctions;\nimport com.pulumi.talos.machine.inputs.GetConfigurationArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var thisSecrets = new Secrets(\"thisSecrets\");\n\n        final var thisConfiguration = MachineFunctions.getConfiguration(GetConfigurationArgs.builder()\n            .clusterName(\"example-cluster\")\n            .machineType(\"controlplane\")\n            .clusterEndpoint(\"https://cluster.local:6443\")\n            .machineSecrets(thisSecrets.machineSecrets())\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  thisSecrets:\n    type: talos:machine:Secrets\nvariables:\n  thisConfiguration:\n    fn::invoke:\n      Function: talos:machine:getConfiguration\n      Arguments:\n        clusterName: example-cluster\n        machineType: controlplane\n        clusterEndpoint: https://cluster.local:6443\n        machineSecrets: ${thisSecrets.machineSecrets}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n",
+            "description": "Generate a machine configuration for a node type\n\n\u003e **Note:** It is recommended to set the optional `talos_version` attribute. Otherwise when using a new version of the provider with a new major version of the Talos SDK, new machineconfig features will be enabled by default which could cause unexpected behavior.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as talos from \"@pulumi/talos\";\nimport * as talos from \"@pulumiverse/talos\";\n\nconst thisSecrets = new talos.machine.Secrets(\"this\", {});\nconst this = talos.machine.getConfigurationOutput({\n    clusterName: \"example-cluster\",\n    machineType: \"controlplane\",\n    clusterEndpoint: \"https://cluster.local:6443\",\n    machineSecrets: thisSecrets.machineSecrets,\n});\n```\n```python\nimport pulumi\nimport pulumi_talos as talos\nimport pulumiverse_talos as talos\n\nthis_secrets = talos.machine.Secrets(\"this\")\nthis = talos.machine.get_configuration_output(cluster_name=\"example-cluster\",\n    machine_type=\"controlplane\",\n    cluster_endpoint=\"https://cluster.local:6443\",\n    machine_secrets=this_secrets.machine_secrets)\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Talos = Pulumi.Talos;\nusing Talos = Pulumiverse.Talos;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var thisSecrets = new Talos.Machine.Secrets(\"this\");\n\n    var @this = Talos.Machine.GetConfiguration.Invoke(new()\n    {\n        ClusterName = \"example-cluster\",\n        MachineType = \"controlplane\",\n        ClusterEndpoint = \"https://cluster.local:6443\",\n        MachineSecrets = thisSecrets.MachineSecrets,\n    });\n\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n\t\"github.com/pulumiverse/pulumi-talos/sdk/go/talos/machine\"\n)\n\nfunc main() {\n\tpulumi.Run(func(ctx *pulumi.Context) error {\n\t\tthisSecrets, err := machine.NewSecrets(ctx, \"this\", nil)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\t_ = machine.GetConfigurationOutput(ctx, machine.GetConfigurationOutputArgs{\n\t\t\tClusterName:     pulumi.String(\"example-cluster\"),\n\t\t\tMachineType:     pulumi.String(\"controlplane\"),\n\t\t\tClusterEndpoint: pulumi.String(\"https://cluster.local:6443\"),\n\t\t\tMachineSecrets:  thisSecrets.MachineSecrets,\n\t\t}, nil)\n\t\treturn nil\n\t})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.talos.machine.Secrets;\nimport com.pulumi.talos.machine.MachineFunctions;\nimport com.pulumi.talos.machine.inputs.GetConfigurationArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var thisSecrets = new Secrets(\"thisSecrets\");\n\n        final var this = MachineFunctions.getConfiguration(GetConfigurationArgs.builder()\n            .clusterName(\"example-cluster\")\n            .machineType(\"controlplane\")\n            .clusterEndpoint(\"https://cluster.local:6443\")\n            .machineSecrets(thisSecrets.machineSecrets())\n            .build());\n\n    }\n}\n```\n```yaml\nresources:\n  thisSecrets:\n    type: talos:machine:Secrets\n    name: this\nvariables:\n  this:\n    fn::invoke:\n      Function: talos:machine:getConfiguration\n      Arguments:\n        clusterName: example-cluster\n        machineType: controlplane\n        clusterEndpoint: https://cluster.local:6443\n        machineSecrets: ${thisSecrets.machineSecrets}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n",
             "inputs": {
                 "description": "A collection of arguments for invoking getConfiguration.\n",
                 "properties": {
@@ -1554,55 +1556,54 @@
                 "description": "A collection of values returned by getConfiguration.\n",
                 "properties": {
                     "clusterEndpoint": {
-                        "type": "string",
-                        "description": "The endpoint of the talos kubernetes cluster\n"
+                        "description": "The endpoint of the talos kubernetes cluster\n",
+                        "type": "string"
                     },
                     "clusterName": {
-                        "type": "string",
-                        "description": "The name of the talos kubernetes cluster\n"
+                        "description": "The name of the talos kubernetes cluster\n",
+                        "type": "string"
                     },
                     "configPatches": {
-                        "type": "array",
+                        "description": "The list of config patches to apply to the generated configuration\n",
                         "items": {
                             "type": "string"
                         },
-                        "description": "The list of config patches to apply to the generated configuration\n"
+                        "type": "array"
                     },
                     "docs": {
-                        "type": "boolean",
-                        "description": "Whether to generate documentation for the generated configuration\n"
+                        "description": "Whether to generate documentation for the generated configuration\n",
+                        "type": "boolean"
                     },
                     "examples": {
-                        "type": "boolean",
-                        "description": "Whether to generate examples for the generated configuration\n"
+                        "description": "Whether to generate examples for the generated configuration\n",
+                        "type": "boolean"
                     },
                     "id": {
-                        "type": "string",
-                        "description": "The ID of this resource.\n"
+                        "description": "The ID of this resource.\n",
+                        "type": "string"
                     },
                     "kubernetesVersion": {
-                        "type": "string",
-                        "description": "The version of kubernetes to use\n"
+                        "description": "The version of kubernetes to use\n",
+                        "type": "string"
                     },
                     "machineConfiguration": {
-                        "type": "string",
                         "description": "The generated machine configuration\n",
-                        "secret": true
+                        "secret": true,
+                        "type": "string"
                     },
                     "machineSecrets": {
                         "$ref": "#/types/talos:machine/generated:MachineSecrets",
                         "description": "The secrets for the talos cluster\n"
                     },
                     "machineType": {
-                        "type": "string",
-                        "description": "The type of machine to generate the configuration for\n"
+                        "description": "The type of machine to generate the configuration for\n",
+                        "type": "string"
                     },
                     "talosVersion": {
-                        "type": "string",
-                        "description": "The version of talos features to use in generated machine configuration\n"
+                        "description": "The version of talos features to use in generated machine configuration\n",
+                        "type": "string"
                     }
                 },
-                "type": "object",
                 "required": [
                     "clusterEndpoint",
                     "clusterName",
@@ -1610,11 +1611,12 @@
                     "machineConfiguration",
                     "machineSecrets",
                     "machineType"
-                ]
+                ],
+                "type": "object"
             }
         },
         "talos:machine/getDisks:getDisks": {
-            "description": "Generate a machine configuration for a node type\n\n\u003e **Note:** Since Talos natively supports `.machine.install.diskSelector`, the `talos.machine.getDisks` data source maybe just used to query disk information that could be used elsewhere. It's recommended to use `machine.install.diskSelector` in Talos machine configuration.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as talos from \"@pulumi/talos\";\nimport * as talos from \"@pulumiverse/talos\";\n\nconst thisSecrets = new talos.machine.Secrets(\"thisSecrets\", {});\nconst thisDisks = talos.machine.getDisksOutput({\n    clientConfiguration: thisSecrets.clientConfiguration,\n    node: \"10.5.0.2\",\n    filters: {\n        size: \"\u003e 100GB\",\n        type: \"nvme\",\n    },\n});\nexport const nvmeDisks = thisDisks.apply(thisDisks =\u003e thisDisks.disks.map(__item =\u003e __item.name));\n```\n```python\nimport pulumi\nimport pulumi_talos as talos\nimport pulumiverse_talos as talos\n\nthis_secrets = talos.machine.Secrets(\"thisSecrets\")\nthis_disks = talos.machine.get_disks_output(client_configuration=this_secrets.client_configuration,\n    node=\"10.5.0.2\",\n    filters={\n        \"size\": \"\u003e 100GB\",\n        \"type\": \"nvme\",\n    })\npulumi.export(\"nvmeDisks\", this_disks.apply(lambda this_disks: [__item.name for __item in this_disks.disks]))\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Talos = Pulumi.Talos;\nusing Talos = Pulumiverse.Talos;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var thisSecrets = new Talos.Machine.Secrets(\"thisSecrets\");\n\n    var thisDisks = Talos.Machine.GetDisks.Invoke(new()\n    {\n        ClientConfiguration = thisSecrets.ClientConfiguration,\n        Node = \"10.5.0.2\",\n        Filters = new Talos.Machine.Inputs.GetDisksFiltersInputArgs\n        {\n            Size = \"\u003e 100GB\",\n            Type = \"nvme\",\n        },\n    });\n\n    return new Dictionary\u003cstring, object?\u003e\n    {\n        [\"nvmeDisks\"] = thisDisks.Apply(getDisksResult =\u003e getDisksResult.Disks).Select(__item =\u003e __item.Name).ToList(),\n    };\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n\t\"github.com/pulumiverse/pulumi-talos/sdk/go/talos/machine\"\n)\nfunc main() {\npulumi.Run(func(ctx *pulumi.Context) error {\nthisSecrets, err := machine.NewSecrets(ctx, \"thisSecrets\", nil)\nif err != nil {\nreturn err\n}\nthisDisks := machine.GetDisksOutput(ctx, machine.GetDisksOutputArgs{\nClientConfiguration: thisSecrets.ClientConfiguration,\nNode: pulumi.String(\"10.5.0.2\"),\nFilters: \u0026machine.GetDisksFiltersArgs{\nSize: pulumi.String(\"\u003e 100GB\"),\nType: pulumi.String(\"nvme\"),\n},\n}, nil);\nctx.Export(\"nvmeDisks\", thisDisks.ApplyT(func(thisDisks machine.GetDisksResult) ([]*string, error) {\nvar splat0 []*string\nfor _, val0 := range thisDisks.Disks {\nsplat0 = append(splat0, val0.Name)\n}\nreturn splat0, nil\n}).(pulumi.[]*stringOutput))\nreturn nil\n})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.talos.machine.Secrets;\nimport com.pulumi.talos.machine.MachineFunctions;\nimport com.pulumi.talos.machine.inputs.GetDisksArgs;\nimport com.pulumi.talos.machine.inputs.GetDisksFiltersArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var thisSecrets = new Secrets(\"thisSecrets\");\n\n        final var thisDisks = MachineFunctions.getDisks(GetDisksArgs.builder()\n            .clientConfiguration(thisSecrets.clientConfiguration())\n            .node(\"10.5.0.2\")\n            .filters(GetDisksFiltersArgs.builder()\n                .size(\"\u003e 100GB\")\n                .type(\"nvme\")\n                .build())\n            .build());\n\n        ctx.export(\"nvmeDisks\", thisDisks.applyValue(getDisksResult -\u003e getDisksResult).applyValue(thisDisks -\u003e thisDisks.applyValue(getDisksResult -\u003e getDisksResult.disks()).stream().map(element -\u003e element.name()).collect(toList())));\n    }\n}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n",
+            "description": "Generate a machine configuration for a node type\n\n\u003e **Note:** Since Talos natively supports `.machine.install.diskSelector`, the `talos.machine.getDisks` data source maybe just used to query disk information that could be used elsewhere. It's recommended to use `machine.install.diskSelector` in Talos machine configuration.\n\n## Example Usage\n\n\u003c!--Start PulumiCodeChooser --\u003e\n```typescript\nimport * as pulumi from \"@pulumi/pulumi\";\nimport * as talos from \"@pulumi/talos\";\nimport * as talos from \"@pulumiverse/talos\";\n\nconst thisSecrets = new talos.machine.Secrets(\"this\", {});\nconst this = talos.machine.getDisksOutput({\n    clientConfiguration: thisSecrets.clientConfiguration,\n    node: \"10.5.0.2\",\n    filters: {\n        size: \"\u003e 100GB\",\n        type: \"nvme\",\n    },\n});\nexport const nvmeDisks = _this.apply(_this =\u003e _this.disks.map(__item =\u003e __item.name));\n```\n```python\nimport pulumi\nimport pulumi_talos as talos\nimport pulumiverse_talos as talos\n\nthis_secrets = talos.machine.Secrets(\"this\")\nthis = talos.machine.get_disks_output(client_configuration=this_secrets.client_configuration,\n    node=\"10.5.0.2\",\n    filters={\n        \"size\": \"\u003e 100GB\",\n        \"type\": \"nvme\",\n    })\npulumi.export(\"nvmeDisks\", this.apply(lambda this: [__item.name for __item in this.disks]))\n```\n```csharp\nusing System.Collections.Generic;\nusing System.Linq;\nusing Pulumi;\nusing Talos = Pulumi.Talos;\nusing Talos = Pulumiverse.Talos;\n\nreturn await Deployment.RunAsync(() =\u003e \n{\n    var thisSecrets = new Talos.Machine.Secrets(\"this\");\n\n    var @this = Talos.Machine.GetDisks.Invoke(new()\n    {\n        ClientConfiguration = thisSecrets.ClientConfiguration,\n        Node = \"10.5.0.2\",\n        Filters = new Talos.Machine.Inputs.GetDisksFiltersInputArgs\n        {\n            Size = \"\u003e 100GB\",\n            Type = \"nvme\",\n        },\n    });\n\n    return new Dictionary\u003cstring, object?\u003e\n    {\n        [\"nvmeDisks\"] = @this.Apply(@this =\u003e @this.Apply(getDisksResult =\u003e getDisksResult.Disks).Select(__item =\u003e __item.Name).ToList()),\n    };\n});\n```\n```go\npackage main\n\nimport (\n\t\"github.com/pulumi/pulumi/sdk/v3/go/pulumi\"\n\t\"github.com/pulumiverse/pulumi-talos/sdk/go/talos/machine\"\n)\nfunc main() {\npulumi.Run(func(ctx *pulumi.Context) error {\nthisSecrets, err := machine.NewSecrets(ctx, \"this\", nil)\nif err != nil {\nreturn err\n}\nthis := machine.GetDisksOutput(ctx, machine.GetDisksOutputArgs{\nClientConfiguration: thisSecrets.ClientConfiguration,\nNode: pulumi.String(\"10.5.0.2\"),\nFilters: \u0026machine.GetDisksFiltersArgs{\nSize: pulumi.String(\"\u003e 100GB\"),\nType: pulumi.String(\"nvme\"),\n},\n}, nil);\nctx.Export(\"nvmeDisks\", this.ApplyT(func(this machine.GetDisksResult) ([]*string, error) {\nvar splat0 []*string\nfor _, val0 := range this.Disks {\nsplat0 = append(splat0, val0.Name)\n}\nreturn splat0, nil\n}).(pulumi.[]*stringOutput))\nreturn nil\n})\n}\n```\n```java\npackage generated_program;\n\nimport com.pulumi.Context;\nimport com.pulumi.Pulumi;\nimport com.pulumi.core.Output;\nimport com.pulumi.talos.machine.Secrets;\nimport com.pulumi.talos.machine.MachineFunctions;\nimport com.pulumi.talos.machine.inputs.GetDisksArgs;\nimport com.pulumi.talos.machine.inputs.GetDisksFiltersArgs;\nimport java.util.List;\nimport java.util.ArrayList;\nimport java.util.Map;\nimport java.io.File;\nimport java.nio.file.Files;\nimport java.nio.file.Paths;\n\npublic class App {\n    public static void main(String[] args) {\n        Pulumi.run(App::stack);\n    }\n\n    public static void stack(Context ctx) {\n        var thisSecrets = new Secrets(\"thisSecrets\");\n\n        final var this = MachineFunctions.getDisks(GetDisksArgs.builder()\n            .clientConfiguration(thisSecrets.clientConfiguration())\n            .node(\"10.5.0.2\")\n            .filters(GetDisksFiltersArgs.builder()\n                .size(\"\u003e 100GB\")\n                .type(\"nvme\")\n                .build())\n            .build());\n\n        ctx.export(\"nvmeDisks\", this_.applyValue(this_ -\u003e this_.disks().stream().map(element -\u003e element.name()).collect(toList())));\n    }\n}\n```\n\u003c!--End PulumiCodeChooser --\u003e\n",
             "inputs": {
                 "description": "A collection of arguments for invoking getDisks.\n",
                 "properties": {
@@ -1652,40 +1654,40 @@
                         "description": "The client configuration data\n"
                     },
                     "disks": {
-                        "type": "array",
+                        "description": "The disks that match the filters\n",
                         "items": {
                             "$ref": "#/types/talos:machine/getDisksDisk:getDisksDisk"
                         },
-                        "description": "The disks that match the filters\n"
+                        "type": "array"
                     },
                     "endpoint": {
-                        "type": "string",
-                        "description": "endpoint to use for the talosclient. If not set, the node value will be used\n"
+                        "description": "endpoint to use for the talosclient. If not set, the node value will be used\n",
+                        "type": "string"
                     },
                     "filters": {
                         "$ref": "#/types/talos:machine/getDisksFilters:getDisksFilters",
                         "description": "Filters to apply to the disks\n"
                     },
                     "id": {
-                        "type": "string",
-                        "description": "The generated ID of this resource\n"
+                        "description": "The generated ID of this resource\n",
+                        "type": "string"
                     },
                     "node": {
-                        "type": "string",
-                        "description": "controlplane node to retrieve the kubeconfig from\n"
+                        "description": "controlplane node to retrieve the kubeconfig from\n",
+                        "type": "string"
                     },
                     "timeouts": {
                         "$ref": "#/types/talos:machine/getDisksTimeouts:getDisksTimeouts"
                     }
                 },
-                "type": "object",
                 "required": [
                     "clientConfiguration",
                     "disks",
                     "endpoint",
                     "id",
                     "node"
-                ]
+                ],
+                "type": "object"
             }
         }
     }
diff --git a/provider/resources.go b/provider/resources.go
index 574c0dce..65b02a2a 100644
--- a/provider/resources.go
+++ b/provider/resources.go
@@ -323,6 +323,7 @@ func Provider() tfbridge.ProviderInfo {
 			Requires: map[string]string{
 				"pulumi": ">=3.0.0,<4.0.0",
 			},
+			PyProject: struct{ Enabled bool }{true},
 		},
 		Golang: &tfbridge.GolangInfo{
 			ImportBasePath: filepath.Join(
diff --git a/sdk/dotnet/Client/GetConfiguration.cs b/sdk/dotnet/Client/GetConfiguration.cs
index 3bc35b0e..16eaea7c 100644
--- a/sdk/dotnet/Client/GetConfiguration.cs
+++ b/sdk/dotnet/Client/GetConfiguration.cs
@@ -26,9 +26,9 @@ public static class GetConfiguration
         /// 
         /// return await Deployment.RunAsync(() =&gt; 
         /// {
-        ///     var thisSecrets = new Talos.Machine.Secrets("thisSecrets");
+        ///     var thisSecrets = new Talos.Machine.Secrets("this");
         /// 
-        ///     var thisConfiguration = Talos.Client.GetConfiguration.Invoke(new()
+        ///     var @this = Talos.Client.GetConfiguration.Invoke(new()
         ///     {
         ///         ClusterName = "example-cluster",
         ///         ClientConfiguration = thisSecrets.ClientConfiguration,
@@ -58,9 +58,9 @@ public static Task<GetConfigurationResult> InvokeAsync(GetConfigurationArgs args
         /// 
         /// return await Deployment.RunAsync(() =&gt; 
         /// {
-        ///     var thisSecrets = new Talos.Machine.Secrets("thisSecrets");
+        ///     var thisSecrets = new Talos.Machine.Secrets("this");
         /// 
-        ///     var thisConfiguration = Talos.Client.GetConfiguration.Invoke(new()
+        ///     var @this = Talos.Client.GetConfiguration.Invoke(new()
         ///     {
         ///         ClusterName = "example-cluster",
         ///         ClientConfiguration = thisSecrets.ClientConfiguration,
diff --git a/sdk/dotnet/Machine/GetConfiguration.cs b/sdk/dotnet/Machine/GetConfiguration.cs
index 1483179f..ef5d3450 100644
--- a/sdk/dotnet/Machine/GetConfiguration.cs
+++ b/sdk/dotnet/Machine/GetConfiguration.cs
@@ -28,9 +28,9 @@ public static class GetConfiguration
         /// 
         /// return await Deployment.RunAsync(() =&gt; 
         /// {
-        ///     var thisSecrets = new Talos.Machine.Secrets("thisSecrets");
+        ///     var thisSecrets = new Talos.Machine.Secrets("this");
         /// 
-        ///     var thisConfiguration = Talos.Machine.GetConfiguration.Invoke(new()
+        ///     var @this = Talos.Machine.GetConfiguration.Invoke(new()
         ///     {
         ///         ClusterName = "example-cluster",
         ///         MachineType = "controlplane",
@@ -60,9 +60,9 @@ public static Task<GetConfigurationResult> InvokeAsync(GetConfigurationArgs args
         /// 
         /// return await Deployment.RunAsync(() =&gt; 
         /// {
-        ///     var thisSecrets = new Talos.Machine.Secrets("thisSecrets");
+        ///     var thisSecrets = new Talos.Machine.Secrets("this");
         /// 
-        ///     var thisConfiguration = Talos.Machine.GetConfiguration.Invoke(new()
+        ///     var @this = Talos.Machine.GetConfiguration.Invoke(new()
         ///     {
         ///         ClusterName = "example-cluster",
         ///         MachineType = "controlplane",
diff --git a/sdk/dotnet/Machine/GetDisks.cs b/sdk/dotnet/Machine/GetDisks.cs
index bc4816f4..77db8150 100644
--- a/sdk/dotnet/Machine/GetDisks.cs
+++ b/sdk/dotnet/Machine/GetDisks.cs
@@ -28,9 +28,9 @@ public static class GetDisks
         /// 
         /// return await Deployment.RunAsync(() =&gt; 
         /// {
-        ///     var thisSecrets = new Talos.Machine.Secrets("thisSecrets");
+        ///     var thisSecrets = new Talos.Machine.Secrets("this");
         /// 
-        ///     var thisDisks = Talos.Machine.GetDisks.Invoke(new()
+        ///     var @this = Talos.Machine.GetDisks.Invoke(new()
         ///     {
         ///         ClientConfiguration = thisSecrets.ClientConfiguration,
         ///         Node = "10.5.0.2",
@@ -43,7 +43,7 @@ public static class GetDisks
         /// 
         ///     return new Dictionary&lt;string, object?&gt;
         ///     {
-        ///         ["nvmeDisks"] = thisDisks.Apply(getDisksResult =&gt; getDisksResult.Disks).Select(__item =&gt; __item.Name).ToList(),
+        ///         ["nvmeDisks"] = @this.Apply(@this =&gt; @this.Apply(getDisksResult =&gt; getDisksResult.Disks).Select(__item =&gt; __item.Name).ToList()),
         ///     };
         /// });
         /// ```
@@ -67,9 +67,9 @@ public static Task<GetDisksResult> InvokeAsync(GetDisksArgs args, InvokeOptions?
         /// 
         /// return await Deployment.RunAsync(() =&gt; 
         /// {
-        ///     var thisSecrets = new Talos.Machine.Secrets("thisSecrets");
+        ///     var thisSecrets = new Talos.Machine.Secrets("this");
         /// 
-        ///     var thisDisks = Talos.Machine.GetDisks.Invoke(new()
+        ///     var @this = Talos.Machine.GetDisks.Invoke(new()
         ///     {
         ///         ClientConfiguration = thisSecrets.ClientConfiguration,
         ///         Node = "10.5.0.2",
@@ -82,7 +82,7 @@ public static Task<GetDisksResult> InvokeAsync(GetDisksArgs args, InvokeOptions?
         /// 
         ///     return new Dictionary&lt;string, object?&gt;
         ///     {
-        ///         ["nvmeDisks"] = thisDisks.Apply(getDisksResult =&gt; getDisksResult.Disks).Select(__item =&gt; __item.Name).ToList(),
+        ///         ["nvmeDisks"] = @this.Apply(@this =&gt; @this.Apply(getDisksResult =&gt; getDisksResult.Disks).Select(__item =&gt; __item.Name).ToList()),
         ///     };
         /// });
         /// ```
diff --git a/sdk/dotnet/Machine/Secrets.cs b/sdk/dotnet/Machine/Secrets.cs
index f4be2e6a..a52c4453 100644
--- a/sdk/dotnet/Machine/Secrets.cs
+++ b/sdk/dotnet/Machine/Secrets.cs
@@ -23,7 +23,7 @@ namespace Pulumiverse.Talos.Machine
     /// 
     /// return await Deployment.RunAsync(() =&gt; 
     /// {
-    ///     var machineSecrets = new Talos.Machine.Secrets("machineSecrets");
+    ///     var machineSecrets = new Talos.Machine.Secrets("machine_secrets");
     /// 
     /// });
     /// ```
diff --git a/sdk/dotnet/go.mod b/sdk/dotnet/go.mod
new file mode 100644
index 00000000..ba429472
--- /dev/null
+++ b/sdk/dotnet/go.mod
@@ -0,0 +1,3 @@
+module fake_dotnet_module // Exclude this directory from Go tools
+
+go 1.17
diff --git a/sdk/go/talos/client/getConfiguration.go b/sdk/go/talos/client/getConfiguration.go
index a140fe32..4e90e8a8 100644
--- a/sdk/go/talos/client/getConfiguration.go
+++ b/sdk/go/talos/client/getConfiguration.go
@@ -28,7 +28,7 @@ import (
 //
 //	func main() {
 //		pulumi.Run(func(ctx *pulumi.Context) error {
-//			thisSecrets, err := machine.NewSecrets(ctx, "thisSecrets", nil)
+//			thisSecrets, err := machine.NewSecrets(ctx, "this", nil)
 //			if err != nil {
 //				return err
 //			}
diff --git a/sdk/go/talos/machine/getConfiguration.go b/sdk/go/talos/machine/getConfiguration.go
index 722e5a38..151c4b9e 100644
--- a/sdk/go/talos/machine/getConfiguration.go
+++ b/sdk/go/talos/machine/getConfiguration.go
@@ -29,7 +29,7 @@ import (
 //
 //	func main() {
 //		pulumi.Run(func(ctx *pulumi.Context) error {
-//			thisSecrets, err := machine.NewSecrets(ctx, "thisSecrets", nil)
+//			thisSecrets, err := machine.NewSecrets(ctx, "this", nil)
 //			if err != nil {
 //				return err
 //			}
diff --git a/sdk/go/talos/machine/getDisks.go b/sdk/go/talos/machine/getDisks.go
index ba752fb9..ce6cf9a1 100644
--- a/sdk/go/talos/machine/getDisks.go
+++ b/sdk/go/talos/machine/getDisks.go
@@ -28,11 +28,11 @@ import (
 // )
 // func main() {
 // pulumi.Run(func(ctx *pulumi.Context) error {
-// thisSecrets, err := machine.NewSecrets(ctx, "thisSecrets", nil)
+// thisSecrets, err := machine.NewSecrets(ctx, "this", nil)
 // if err != nil {
 // return err
 // }
-// thisDisks := machine.GetDisksOutput(ctx, machine.GetDisksOutputArgs{
+// this := machine.GetDisksOutput(ctx, machine.GetDisksOutputArgs{
 // ClientConfiguration: thisSecrets.ClientConfiguration,
 // Node: pulumi.String("10.5.0.2"),
 // Filters: &machine.GetDisksFiltersArgs{
@@ -40,9 +40,9 @@ import (
 // Type: pulumi.String("nvme"),
 // },
 // }, nil);
-// ctx.Export("nvmeDisks", thisDisks.ApplyT(func(thisDisks machine.GetDisksResult) ([]*string, error) {
+// ctx.Export("nvmeDisks", this.ApplyT(func(this machine.GetDisksResult) ([]*string, error) {
 // var splat0 []*string
-// for _, val0 := range thisDisks.Disks {
+// for _, val0 := range this.Disks {
 // splat0 = append(splat0, val0.Name)
 // }
 // return splat0, nil
diff --git a/sdk/go/talos/machine/secrets.go b/sdk/go/talos/machine/secrets.go
index aae0dc0e..6e1fde23 100644
--- a/sdk/go/talos/machine/secrets.go
+++ b/sdk/go/talos/machine/secrets.go
@@ -27,7 +27,7 @@ import (
 //
 //	func main() {
 //		pulumi.Run(func(ctx *pulumi.Context) error {
-//			_, err := machine.NewSecrets(ctx, "machineSecrets", nil)
+//			_, err := machine.NewSecrets(ctx, "machine_secrets", nil)
 //			if err != nil {
 //				return err
 //			}
diff --git a/sdk/nodejs/client/getConfiguration.ts b/sdk/nodejs/client/getConfiguration.ts
index 804fd01d..2a57a62b 100644
--- a/sdk/nodejs/client/getConfiguration.ts
+++ b/sdk/nodejs/client/getConfiguration.ts
@@ -16,8 +16,8 @@ import * as utilities from "../utilities";
  * import * as talos from "@pulumi/talos";
  * import * as talos from "@pulumiverse/talos";
  *
- * const thisSecrets = new talos.machine.Secrets("thisSecrets", {});
- * const thisConfiguration = talos.client.getConfigurationOutput({
+ * const thisSecrets = new talos.machine.Secrets("this", {});
+ * const this = talos.client.getConfigurationOutput({
  *     clusterName: "example-cluster",
  *     clientConfiguration: thisSecrets.clientConfiguration,
  *     nodes: ["10.5.0.2"],
@@ -96,8 +96,8 @@ export interface GetConfigurationResult {
  * import * as talos from "@pulumi/talos";
  * import * as talos from "@pulumiverse/talos";
  *
- * const thisSecrets = new talos.machine.Secrets("thisSecrets", {});
- * const thisConfiguration = talos.client.getConfigurationOutput({
+ * const thisSecrets = new talos.machine.Secrets("this", {});
+ * const this = talos.client.getConfigurationOutput({
  *     clusterName: "example-cluster",
  *     clientConfiguration: thisSecrets.clientConfiguration,
  *     nodes: ["10.5.0.2"],
diff --git a/sdk/nodejs/go.mod b/sdk/nodejs/go.mod
new file mode 100644
index 00000000..104eb1a8
--- /dev/null
+++ b/sdk/nodejs/go.mod
@@ -0,0 +1,3 @@
+module fake_nodejs_module // Exclude this directory from Go tools
+
+go 1.17
diff --git a/sdk/nodejs/machine/getConfiguration.ts b/sdk/nodejs/machine/getConfiguration.ts
index 6e06b80b..5eece5b1 100644
--- a/sdk/nodejs/machine/getConfiguration.ts
+++ b/sdk/nodejs/machine/getConfiguration.ts
@@ -18,8 +18,8 @@ import * as utilities from "../utilities";
  * import * as talos from "@pulumi/talos";
  * import * as talos from "@pulumiverse/talos";
  *
- * const thisSecrets = new talos.machine.Secrets("thisSecrets", {});
- * const thisConfiguration = talos.machine.getConfigurationOutput({
+ * const thisSecrets = new talos.machine.Secrets("this", {});
+ * const this = talos.machine.getConfigurationOutput({
  *     clusterName: "example-cluster",
  *     machineType: "controlplane",
  *     clusterEndpoint: "https://cluster.local:6443",
@@ -146,8 +146,8 @@ export interface GetConfigurationResult {
  * import * as talos from "@pulumi/talos";
  * import * as talos from "@pulumiverse/talos";
  *
- * const thisSecrets = new talos.machine.Secrets("thisSecrets", {});
- * const thisConfiguration = talos.machine.getConfigurationOutput({
+ * const thisSecrets = new talos.machine.Secrets("this", {});
+ * const this = talos.machine.getConfigurationOutput({
  *     clusterName: "example-cluster",
  *     machineType: "controlplane",
  *     clusterEndpoint: "https://cluster.local:6443",
diff --git a/sdk/nodejs/machine/getDisks.ts b/sdk/nodejs/machine/getDisks.ts
index af82233c..708e15f5 100644
--- a/sdk/nodejs/machine/getDisks.ts
+++ b/sdk/nodejs/machine/getDisks.ts
@@ -18,8 +18,8 @@ import * as utilities from "../utilities";
  * import * as talos from "@pulumi/talos";
  * import * as talos from "@pulumiverse/talos";
  *
- * const thisSecrets = new talos.machine.Secrets("thisSecrets", {});
- * const thisDisks = talos.machine.getDisksOutput({
+ * const thisSecrets = new talos.machine.Secrets("this", {});
+ * const this = talos.machine.getDisksOutput({
  *     clientConfiguration: thisSecrets.clientConfiguration,
  *     node: "10.5.0.2",
  *     filters: {
@@ -27,7 +27,7 @@ import * as utilities from "../utilities";
  *         type: "nvme",
  *     },
  * });
- * export const nvmeDisks = thisDisks.apply(thisDisks => thisDisks.disks.map(__item => __item.name));
+ * export const nvmeDisks = _this.apply(_this => _this.disks.map(__item => __item.name));
  * ```
  */
 export function getDisks(args: GetDisksArgs, opts?: pulumi.InvokeOptions): Promise<GetDisksResult> {
@@ -107,8 +107,8 @@ export interface GetDisksResult {
  * import * as talos from "@pulumi/talos";
  * import * as talos from "@pulumiverse/talos";
  *
- * const thisSecrets = new talos.machine.Secrets("thisSecrets", {});
- * const thisDisks = talos.machine.getDisksOutput({
+ * const thisSecrets = new talos.machine.Secrets("this", {});
+ * const this = talos.machine.getDisksOutput({
  *     clientConfiguration: thisSecrets.clientConfiguration,
  *     node: "10.5.0.2",
  *     filters: {
@@ -116,7 +116,7 @@ export interface GetDisksResult {
  *         type: "nvme",
  *     },
  * });
- * export const nvmeDisks = thisDisks.apply(thisDisks => thisDisks.disks.map(__item => __item.name));
+ * export const nvmeDisks = _this.apply(_this => _this.disks.map(__item => __item.name));
  * ```
  */
 export function getDisksOutput(args: GetDisksOutputArgs, opts?: pulumi.InvokeOptions): pulumi.Output<GetDisksResult> {
diff --git a/sdk/nodejs/machine/secrets.ts b/sdk/nodejs/machine/secrets.ts
index 8ead4013..57c75933 100644
--- a/sdk/nodejs/machine/secrets.ts
+++ b/sdk/nodejs/machine/secrets.ts
@@ -15,7 +15,7 @@ import * as utilities from "../utilities";
  * import * as pulumi from "@pulumi/pulumi";
  * import * as talos from "@pulumiverse/talos";
  *
- * const machineSecrets = new talos.machine.Secrets("machineSecrets", {});
+ * const machineSecrets = new talos.machine.Secrets("machine_secrets", {});
  * ```
  *
  * ## Import
diff --git a/sdk/python/go.mod b/sdk/python/go.mod
new file mode 100644
index 00000000..b91fcbc3
--- /dev/null
+++ b/sdk/python/go.mod
@@ -0,0 +1,3 @@
+module fake_python_module // Exclude this directory from Go tools
+
+go 1.17
diff --git a/sdk/python/pulumiverse_talos/client/configuration.py b/sdk/python/pulumiverse_talos/client/configuration.py
deleted file mode 100644
index d35d8034..00000000
--- a/sdk/python/pulumiverse_talos/client/configuration.py
+++ /dev/null
@@ -1,181 +0,0 @@
-# coding=utf-8
-# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
-# *** Do not edit by hand unless you're certain you know what you are doing! ***
-
-import copy
-import warnings
-import pulumi
-import pulumi.runtime
-from typing import Any, Mapping, Optional, Sequence, Union, overload
-from .. import _utilities
-from . import outputs
-from ._inputs import *
-
-__all__ = [
-    'ConfigurationResult',
-    'AwaitableConfigurationResult',
-    'configuration',
-    'configuration_output',
-]
-
-@pulumi.output_type
-class ConfigurationResult:
-    """
-    A collection of values returned by Configuration.
-    """
-    def __init__(__self__, client_configuration=None, cluster_name=None, endpoints=None, id=None, nodes=None, talos_config=None):
-        if client_configuration and not isinstance(client_configuration, dict):
-            raise TypeError("Expected argument 'client_configuration' to be a dict")
-        pulumi.set(__self__, "client_configuration", client_configuration)
-        if cluster_name and not isinstance(cluster_name, str):
-            raise TypeError("Expected argument 'cluster_name' to be a str")
-        pulumi.set(__self__, "cluster_name", cluster_name)
-        if endpoints and not isinstance(endpoints, list):
-            raise TypeError("Expected argument 'endpoints' to be a list")
-        pulumi.set(__self__, "endpoints", endpoints)
-        if id and not isinstance(id, str):
-            raise TypeError("Expected argument 'id' to be a str")
-        pulumi.set(__self__, "id", id)
-        if nodes and not isinstance(nodes, list):
-            raise TypeError("Expected argument 'nodes' to be a list")
-        pulumi.set(__self__, "nodes", nodes)
-        if talos_config and not isinstance(talos_config, str):
-            raise TypeError("Expected argument 'talos_config' to be a str")
-        pulumi.set(__self__, "talos_config", talos_config)
-
-    @property
-    @pulumi.getter(name="clientConfiguration")
-    def client_configuration(self) -> 'outputs.ConfigurationClientConfigurationResult':
-        """
-        The client configuration data
-        """
-        return pulumi.get(self, "client_configuration")
-
-    @property
-    @pulumi.getter(name="clusterName")
-    def cluster_name(self) -> str:
-        """
-        The name of the cluster in the generated config
-        """
-        return pulumi.get(self, "cluster_name")
-
-    @property
-    @pulumi.getter
-    def endpoints(self) -> Optional[Sequence[str]]:
-        """
-        endpoints to set in the generated config
-        """
-        return pulumi.get(self, "endpoints")
-
-    @property
-    @pulumi.getter
-    def id(self) -> str:
-        """
-        The ID of this resource
-        """
-        return pulumi.get(self, "id")
-
-    @property
-    @pulumi.getter
-    def nodes(self) -> Optional[Sequence[str]]:
-        """
-        nodes to set in the generated config
-        """
-        return pulumi.get(self, "nodes")
-
-    @property
-    @pulumi.getter(name="talosConfig")
-    def talos_config(self) -> str:
-        """
-        The generated client configuration
-        """
-        return pulumi.get(self, "talos_config")
-
-
-class AwaitableConfigurationResult(ConfigurationResult):
-    # pylint: disable=using-constant-test
-    def __await__(self):
-        if False:
-            yield self
-        return ConfigurationResult(
-            client_configuration=self.client_configuration,
-            cluster_name=self.cluster_name,
-            endpoints=self.endpoints,
-            id=self.id,
-            nodes=self.nodes,
-            talos_config=self.talos_config)
-
-
-def configuration(client_configuration: Optional[pulumi.InputType['ConfigurationClientConfigurationArgs']] = None,
-                  cluster_name: Optional[str] = None,
-                  endpoints: Optional[Sequence[str]] = None,
-                  nodes: Optional[Sequence[str]] = None,
-                  opts: Optional[pulumi.InvokeOptions] = None) -> AwaitableConfigurationResult:
-    """
-    Generate client configuration for a Talos cluster
-
-    ## Example Usage
-
-    ```python
-    import pulumi
-    import pulumi_talos as talos
-    import pulumiverse_talos as talos
-
-    this_secrets = talos.machine.Secrets("thisSecrets")
-    this_configuration = talos.client.configuration_output(cluster_name="example-cluster",
-        client_configuration=this_secrets.client_configuration,
-        nodes=["10.5.0.2"])
-    ```
-
-
-    :param pulumi.InputType['ConfigurationClientConfigurationArgs'] client_configuration: The client configuration data
-    :param str cluster_name: The name of the cluster in the generated config
-    :param Sequence[str] endpoints: endpoints to set in the generated config
-    :param Sequence[str] nodes: nodes to set in the generated config
-    """
-    __args__ = dict()
-    __args__['clientConfiguration'] = client_configuration
-    __args__['clusterName'] = cluster_name
-    __args__['endpoints'] = endpoints
-    __args__['nodes'] = nodes
-    opts = pulumi.InvokeOptions.merge(_utilities.get_invoke_opts_defaults(), opts)
-    __ret__ = pulumi.runtime.invoke('talos:client/configuration:Configuration', __args__, opts=opts, typ=ConfigurationResult).value
-
-    return AwaitableConfigurationResult(
-        client_configuration=pulumi.get(__ret__, 'client_configuration'),
-        cluster_name=pulumi.get(__ret__, 'cluster_name'),
-        endpoints=pulumi.get(__ret__, 'endpoints'),
-        id=pulumi.get(__ret__, 'id'),
-        nodes=pulumi.get(__ret__, 'nodes'),
-        talos_config=pulumi.get(__ret__, 'talos_config'))
-
-
-@_utilities.lift_output_func(configuration)
-def configuration_output(client_configuration: Optional[pulumi.Input[pulumi.InputType['ConfigurationClientConfigurationArgs']]] = None,
-                         cluster_name: Optional[pulumi.Input[str]] = None,
-                         endpoints: Optional[pulumi.Input[Optional[Sequence[str]]]] = None,
-                         nodes: Optional[pulumi.Input[Optional[Sequence[str]]]] = None,
-                         opts: Optional[pulumi.InvokeOptions] = None) -> pulumi.Output[ConfigurationResult]:
-    """
-    Generate client configuration for a Talos cluster
-
-    ## Example Usage
-
-    ```python
-    import pulumi
-    import pulumi_talos as talos
-    import pulumiverse_talos as talos
-
-    this_secrets = talos.machine.Secrets("thisSecrets")
-    this_configuration = talos.client.configuration_output(cluster_name="example-cluster",
-        client_configuration=this_secrets.client_configuration,
-        nodes=["10.5.0.2"])
-    ```
-
-
-    :param pulumi.InputType['ConfigurationClientConfigurationArgs'] client_configuration: The client configuration data
-    :param str cluster_name: The name of the cluster in the generated config
-    :param Sequence[str] endpoints: endpoints to set in the generated config
-    :param Sequence[str] nodes: nodes to set in the generated config
-    """
-    ...
diff --git a/sdk/python/pulumiverse_talos/client/get_configuration.py b/sdk/python/pulumiverse_talos/client/get_configuration.py
index cea0f532..69193dc7 100644
--- a/sdk/python/pulumiverse_talos/client/get_configuration.py
+++ b/sdk/python/pulumiverse_talos/client/get_configuration.py
@@ -121,8 +121,8 @@ def get_configuration(client_configuration: Optional[Union['GetConfigurationClie
     import pulumi_talos as talos
     import pulumiverse_talos as talos
 
-    this_secrets = talos.machine.Secrets("thisSecrets")
-    this_configuration = talos.client.get_configuration_output(cluster_name="example-cluster",
+    this_secrets = talos.machine.Secrets("this")
+    this = talos.client.get_configuration_output(cluster_name="example-cluster",
         client_configuration=this_secrets.client_configuration,
         nodes=["10.5.0.2"])
     ```
@@ -166,8 +166,8 @@ def get_configuration_output(client_configuration: Optional[pulumi.Input[Union['
     import pulumi_talos as talos
     import pulumiverse_talos as talos
 
-    this_secrets = talos.machine.Secrets("thisSecrets")
-    this_configuration = talos.client.get_configuration_output(cluster_name="example-cluster",
+    this_secrets = talos.machine.Secrets("this")
+    this = talos.client.get_configuration_output(cluster_name="example-cluster",
         client_configuration=this_secrets.client_configuration,
         nodes=["10.5.0.2"])
     ```
diff --git a/sdk/python/pulumiverse_talos/cluster/health.py b/sdk/python/pulumiverse_talos/cluster/health.py
deleted file mode 100644
index 4ed6ca42..00000000
--- a/sdk/python/pulumiverse_talos/cluster/health.py
+++ /dev/null
@@ -1,155 +0,0 @@
-# coding=utf-8
-# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
-# *** Do not edit by hand unless you're certain you know what you are doing! ***
-
-import copy
-import warnings
-import pulumi
-import pulumi.runtime
-from typing import Any, Mapping, Optional, Sequence, Union, overload
-from .. import _utilities
-from . import outputs
-from ._inputs import *
-
-__all__ = [
-    'HealthResult',
-    'AwaitableHealthResult',
-    'health',
-    'health_output',
-]
-
-@pulumi.output_type
-class HealthResult:
-    """
-    A collection of values returned by Health.
-    """
-    def __init__(__self__, client_configuration=None, control_plane_nodes=None, endpoints=None, id=None, timeouts=None, worker_nodes=None):
-        if client_configuration and not isinstance(client_configuration, dict):
-            raise TypeError("Expected argument 'client_configuration' to be a dict")
-        pulumi.set(__self__, "client_configuration", client_configuration)
-        if control_plane_nodes and not isinstance(control_plane_nodes, list):
-            raise TypeError("Expected argument 'control_plane_nodes' to be a list")
-        pulumi.set(__self__, "control_plane_nodes", control_plane_nodes)
-        if endpoints and not isinstance(endpoints, list):
-            raise TypeError("Expected argument 'endpoints' to be a list")
-        pulumi.set(__self__, "endpoints", endpoints)
-        if id and not isinstance(id, str):
-            raise TypeError("Expected argument 'id' to be a str")
-        pulumi.set(__self__, "id", id)
-        if timeouts and not isinstance(timeouts, dict):
-            raise TypeError("Expected argument 'timeouts' to be a dict")
-        pulumi.set(__self__, "timeouts", timeouts)
-        if worker_nodes and not isinstance(worker_nodes, list):
-            raise TypeError("Expected argument 'worker_nodes' to be a list")
-        pulumi.set(__self__, "worker_nodes", worker_nodes)
-
-    @property
-    @pulumi.getter(name="clientConfiguration")
-    def client_configuration(self) -> 'outputs.HealthClientConfigurationResult':
-        """
-        The client configuration data
-        """
-        return pulumi.get(self, "client_configuration")
-
-    @property
-    @pulumi.getter(name="controlPlaneNodes")
-    def control_plane_nodes(self) -> Sequence[str]:
-        """
-        List of control plane nodes to check for health.
-        """
-        return pulumi.get(self, "control_plane_nodes")
-
-    @property
-    @pulumi.getter
-    def endpoints(self) -> Sequence[str]:
-        """
-        endpoints to use for the health check client. Use at least one control plane endpoint.
-        """
-        return pulumi.get(self, "endpoints")
-
-    @property
-    @pulumi.getter
-    def id(self) -> str:
-        """
-        The ID of this resource.
-        """
-        return pulumi.get(self, "id")
-
-    @property
-    @pulumi.getter
-    def timeouts(self) -> Optional['outputs.HealthTimeoutsResult']:
-        return pulumi.get(self, "timeouts")
-
-    @property
-    @pulumi.getter(name="workerNodes")
-    def worker_nodes(self) -> Optional[Sequence[str]]:
-        """
-        List of worker nodes to check for health.
-        """
-        return pulumi.get(self, "worker_nodes")
-
-
-class AwaitableHealthResult(HealthResult):
-    # pylint: disable=using-constant-test
-    def __await__(self):
-        if False:
-            yield self
-        return HealthResult(
-            client_configuration=self.client_configuration,
-            control_plane_nodes=self.control_plane_nodes,
-            endpoints=self.endpoints,
-            id=self.id,
-            timeouts=self.timeouts,
-            worker_nodes=self.worker_nodes)
-
-
-def health(client_configuration: Optional[pulumi.InputType['HealthClientConfigurationArgs']] = None,
-           control_plane_nodes: Optional[Sequence[str]] = None,
-           endpoints: Optional[Sequence[str]] = None,
-           timeouts: Optional[pulumi.InputType['HealthTimeoutsArgs']] = None,
-           worker_nodes: Optional[Sequence[str]] = None,
-           opts: Optional[pulumi.InvokeOptions] = None) -> AwaitableHealthResult:
-    """
-    Checks the health of a Talos cluster
-
-
-    :param pulumi.InputType['HealthClientConfigurationArgs'] client_configuration: The client configuration data
-    :param Sequence[str] control_plane_nodes: List of control plane nodes to check for health.
-    :param Sequence[str] endpoints: endpoints to use for the health check client. Use at least one control plane endpoint.
-    :param Sequence[str] worker_nodes: List of worker nodes to check for health.
-    """
-    __args__ = dict()
-    __args__['clientConfiguration'] = client_configuration
-    __args__['controlPlaneNodes'] = control_plane_nodes
-    __args__['endpoints'] = endpoints
-    __args__['timeouts'] = timeouts
-    __args__['workerNodes'] = worker_nodes
-    opts = pulumi.InvokeOptions.merge(_utilities.get_invoke_opts_defaults(), opts)
-    __ret__ = pulumi.runtime.invoke('talos:cluster/health:Health', __args__, opts=opts, typ=HealthResult).value
-
-    return AwaitableHealthResult(
-        client_configuration=pulumi.get(__ret__, 'client_configuration'),
-        control_plane_nodes=pulumi.get(__ret__, 'control_plane_nodes'),
-        endpoints=pulumi.get(__ret__, 'endpoints'),
-        id=pulumi.get(__ret__, 'id'),
-        timeouts=pulumi.get(__ret__, 'timeouts'),
-        worker_nodes=pulumi.get(__ret__, 'worker_nodes'))
-
-
-@_utilities.lift_output_func(health)
-def health_output(client_configuration: Optional[pulumi.Input[pulumi.InputType['HealthClientConfigurationArgs']]] = None,
-                  control_plane_nodes: Optional[pulumi.Input[Sequence[str]]] = None,
-                  endpoints: Optional[pulumi.Input[Sequence[str]]] = None,
-                  timeouts: Optional[pulumi.Input[Optional[pulumi.InputType['HealthTimeoutsArgs']]]] = None,
-                  worker_nodes: Optional[pulumi.Input[Optional[Sequence[str]]]] = None,
-                  opts: Optional[pulumi.InvokeOptions] = None) -> pulumi.Output[HealthResult]:
-    """
-    Checks the health of a Talos cluster
-
-
-    :param pulumi.InputType['HealthClientConfigurationArgs'] client_configuration: The client configuration data
-    :param Sequence[str] control_plane_nodes: List of control plane nodes to check for health.
-    :param Sequence[str] endpoints: endpoints to use for the health check client. Use at least one control plane endpoint.
-    :param Sequence[str] worker_nodes: List of worker nodes to check for health.
-    """
-    ...
diff --git a/sdk/python/pulumiverse_talos/cluster/kubeconfig.py b/sdk/python/pulumiverse_talos/cluster/kubeconfig.py
deleted file mode 100644
index 2c804992..00000000
--- a/sdk/python/pulumiverse_talos/cluster/kubeconfig.py
+++ /dev/null
@@ -1,184 +0,0 @@
-# coding=utf-8
-# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
-# *** Do not edit by hand unless you're certain you know what you are doing! ***
-
-import copy
-import warnings
-import pulumi
-import pulumi.runtime
-from typing import Any, Mapping, Optional, Sequence, Union, overload
-from .. import _utilities
-from . import outputs
-from ._inputs import *
-
-__all__ = [
-    'KubeconfigResult',
-    'AwaitableKubeconfigResult',
-    'kubeconfig',
-    'kubeconfig_output',
-]
-
-@pulumi.output_type
-class KubeconfigResult:
-    """
-    A collection of values returned by Kubeconfig.
-    """
-    def __init__(__self__, client_configuration=None, endpoint=None, id=None, kubeconfig_raw=None, kubernetes_client_configuration=None, node=None, timeouts=None, wait=None):
-        if client_configuration and not isinstance(client_configuration, dict):
-            raise TypeError("Expected argument 'client_configuration' to be a dict")
-        pulumi.set(__self__, "client_configuration", client_configuration)
-        if endpoint and not isinstance(endpoint, str):
-            raise TypeError("Expected argument 'endpoint' to be a str")
-        pulumi.set(__self__, "endpoint", endpoint)
-        if id and not isinstance(id, str):
-            raise TypeError("Expected argument 'id' to be a str")
-        pulumi.set(__self__, "id", id)
-        if kubeconfig_raw and not isinstance(kubeconfig_raw, str):
-            raise TypeError("Expected argument 'kubeconfig_raw' to be a str")
-        pulumi.set(__self__, "kubeconfig_raw", kubeconfig_raw)
-        if kubernetes_client_configuration and not isinstance(kubernetes_client_configuration, dict):
-            raise TypeError("Expected argument 'kubernetes_client_configuration' to be a dict")
-        pulumi.set(__self__, "kubernetes_client_configuration", kubernetes_client_configuration)
-        if node and not isinstance(node, str):
-            raise TypeError("Expected argument 'node' to be a str")
-        pulumi.set(__self__, "node", node)
-        if timeouts and not isinstance(timeouts, dict):
-            raise TypeError("Expected argument 'timeouts' to be a dict")
-        pulumi.set(__self__, "timeouts", timeouts)
-        if wait and not isinstance(wait, bool):
-            raise TypeError("Expected argument 'wait' to be a bool")
-        pulumi.set(__self__, "wait", wait)
-
-    @property
-    @pulumi.getter(name="clientConfiguration")
-    def client_configuration(self) -> 'outputs.KubeconfigClientConfigurationResult':
-        """
-        The client configuration data
-        """
-        return pulumi.get(self, "client_configuration")
-
-    @property
-    @pulumi.getter
-    def endpoint(self) -> str:
-        """
-        endpoint to use for the talosclient. If not set, the node value will be used
-        """
-        return pulumi.get(self, "endpoint")
-
-    @property
-    @pulumi.getter
-    def id(self) -> str:
-        """
-        The ID of this resource.
-        """
-        return pulumi.get(self, "id")
-
-    @property
-    @pulumi.getter(name="kubeconfigRaw")
-    def kubeconfig_raw(self) -> str:
-        """
-        The raw kubeconfig
-        """
-        return pulumi.get(self, "kubeconfig_raw")
-
-    @property
-    @pulumi.getter(name="kubernetesClientConfiguration")
-    def kubernetes_client_configuration(self) -> 'outputs.KubeconfigKubernetesClientConfigurationResult':
-        """
-        The kubernetes client configuration
-        """
-        return pulumi.get(self, "kubernetes_client_configuration")
-
-    @property
-    @pulumi.getter
-    def node(self) -> str:
-        """
-        controlplane node to retrieve the kubeconfig from
-        """
-        return pulumi.get(self, "node")
-
-    @property
-    @pulumi.getter
-    def timeouts(self) -> Optional['outputs.KubeconfigTimeoutsResult']:
-        return pulumi.get(self, "timeouts")
-
-    @property
-    @pulumi.getter
-    def wait(self) -> Optional[bool]:
-        """
-        Wait for the kubernetes api to be available
-        """
-        warnings.warn("""This attribute is deprecated and no-op. Will be removed in a future version. Use talos_cluster_health instead.""", DeprecationWarning)
-        pulumi.log.warn("""wait is deprecated: This attribute is deprecated and no-op. Will be removed in a future version. Use talos_cluster_health instead.""")
-
-        return pulumi.get(self, "wait")
-
-
-class AwaitableKubeconfigResult(KubeconfigResult):
-    # pylint: disable=using-constant-test
-    def __await__(self):
-        if False:
-            yield self
-        return KubeconfigResult(
-            client_configuration=self.client_configuration,
-            endpoint=self.endpoint,
-            id=self.id,
-            kubeconfig_raw=self.kubeconfig_raw,
-            kubernetes_client_configuration=self.kubernetes_client_configuration,
-            node=self.node,
-            timeouts=self.timeouts,
-            wait=self.wait)
-
-
-def kubeconfig(client_configuration: Optional[pulumi.InputType['KubeconfigClientConfigurationArgs']] = None,
-               endpoint: Optional[str] = None,
-               node: Optional[str] = None,
-               timeouts: Optional[pulumi.InputType['KubeconfigTimeoutsArgs']] = None,
-               wait: Optional[bool] = None,
-               opts: Optional[pulumi.InvokeOptions] = None) -> AwaitableKubeconfigResult:
-    """
-    Retrieves the kubeconfig for a Talos cluster
-
-
-    :param pulumi.InputType['KubeconfigClientConfigurationArgs'] client_configuration: The client configuration data
-    :param str endpoint: endpoint to use for the talosclient. If not set, the node value will be used
-    :param str node: controlplane node to retrieve the kubeconfig from
-    :param bool wait: Wait for the kubernetes api to be available
-    """
-    __args__ = dict()
-    __args__['clientConfiguration'] = client_configuration
-    __args__['endpoint'] = endpoint
-    __args__['node'] = node
-    __args__['timeouts'] = timeouts
-    __args__['wait'] = wait
-    opts = pulumi.InvokeOptions.merge(_utilities.get_invoke_opts_defaults(), opts)
-    __ret__ = pulumi.runtime.invoke('talos:cluster/kubeconfig:Kubeconfig', __args__, opts=opts, typ=KubeconfigResult).value
-
-    return AwaitableKubeconfigResult(
-        client_configuration=pulumi.get(__ret__, 'client_configuration'),
-        endpoint=pulumi.get(__ret__, 'endpoint'),
-        id=pulumi.get(__ret__, 'id'),
-        kubeconfig_raw=pulumi.get(__ret__, 'kubeconfig_raw'),
-        kubernetes_client_configuration=pulumi.get(__ret__, 'kubernetes_client_configuration'),
-        node=pulumi.get(__ret__, 'node'),
-        timeouts=pulumi.get(__ret__, 'timeouts'),
-        wait=pulumi.get(__ret__, 'wait'))
-
-
-@_utilities.lift_output_func(kubeconfig)
-def kubeconfig_output(client_configuration: Optional[pulumi.Input[pulumi.InputType['KubeconfigClientConfigurationArgs']]] = None,
-                      endpoint: Optional[pulumi.Input[Optional[str]]] = None,
-                      node: Optional[pulumi.Input[str]] = None,
-                      timeouts: Optional[pulumi.Input[Optional[pulumi.InputType['KubeconfigTimeoutsArgs']]]] = None,
-                      wait: Optional[pulumi.Input[Optional[bool]]] = None,
-                      opts: Optional[pulumi.InvokeOptions] = None) -> pulumi.Output[KubeconfigResult]:
-    """
-    Retrieves the kubeconfig for a Talos cluster
-
-
-    :param pulumi.InputType['KubeconfigClientConfigurationArgs'] client_configuration: The client configuration data
-    :param str endpoint: endpoint to use for the talosclient. If not set, the node value will be used
-    :param str node: controlplane node to retrieve the kubeconfig from
-    :param bool wait: Wait for the kubernetes api to be available
-    """
-    ...
diff --git a/sdk/python/pulumiverse_talos/machine/configuration.py b/sdk/python/pulumiverse_talos/machine/configuration.py
deleted file mode 100644
index 9c2bbc54..00000000
--- a/sdk/python/pulumiverse_talos/machine/configuration.py
+++ /dev/null
@@ -1,277 +0,0 @@
-# coding=utf-8
-# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
-# *** Do not edit by hand unless you're certain you know what you are doing! ***
-
-import copy
-import warnings
-import pulumi
-import pulumi.runtime
-from typing import Any, Callable, Mapping, Optional, Sequence, Union, overload
-from .. import _utilities
-from . import outputs
-from ._inputs import *
-
-__all__ = [
-    'ConfigurationResult',
-    'AwaitableConfigurationResult',
-    'configuration',
-    'configuration_output',
-]
-
-@pulumi.output_type
-class ConfigurationResult:
-    """
-    A collection of values returned by Configuration.
-    """
-    def __init__(__self__, cluster_endpoint=None, cluster_name=None, config_patches=None, docs=None, examples=None, id=None, kubernetes_version=None, machine_configuration=None, machine_secrets=None, machine_type=None, talos_version=None):
-        if cluster_endpoint and not isinstance(cluster_endpoint, str):
-            raise TypeError("Expected argument 'cluster_endpoint' to be a str")
-        pulumi.set(__self__, "cluster_endpoint", cluster_endpoint)
-        if cluster_name and not isinstance(cluster_name, str):
-            raise TypeError("Expected argument 'cluster_name' to be a str")
-        pulumi.set(__self__, "cluster_name", cluster_name)
-        if config_patches and not isinstance(config_patches, list):
-            raise TypeError("Expected argument 'config_patches' to be a list")
-        pulumi.set(__self__, "config_patches", config_patches)
-        if docs and not isinstance(docs, bool):
-            raise TypeError("Expected argument 'docs' to be a bool")
-        pulumi.set(__self__, "docs", docs)
-        if examples and not isinstance(examples, bool):
-            raise TypeError("Expected argument 'examples' to be a bool")
-        pulumi.set(__self__, "examples", examples)
-        if id and not isinstance(id, str):
-            raise TypeError("Expected argument 'id' to be a str")
-        pulumi.set(__self__, "id", id)
-        if kubernetes_version and not isinstance(kubernetes_version, str):
-            raise TypeError("Expected argument 'kubernetes_version' to be a str")
-        pulumi.set(__self__, "kubernetes_version", kubernetes_version)
-        if machine_configuration and not isinstance(machine_configuration, str):
-            raise TypeError("Expected argument 'machine_configuration' to be a str")
-        pulumi.set(__self__, "machine_configuration", machine_configuration)
-        if machine_secrets and not isinstance(machine_secrets, dict):
-            raise TypeError("Expected argument 'machine_secrets' to be a dict")
-        pulumi.set(__self__, "machine_secrets", machine_secrets)
-        if machine_type and not isinstance(machine_type, str):
-            raise TypeError("Expected argument 'machine_type' to be a str")
-        pulumi.set(__self__, "machine_type", machine_type)
-        if talos_version and not isinstance(talos_version, str):
-            raise TypeError("Expected argument 'talos_version' to be a str")
-        pulumi.set(__self__, "talos_version", talos_version)
-
-    @property
-    @pulumi.getter(name="clusterEndpoint")
-    def cluster_endpoint(self) -> str:
-        """
-        The endpoint of the talos kubernetes cluster
-        """
-        return pulumi.get(self, "cluster_endpoint")
-
-    @property
-    @pulumi.getter(name="clusterName")
-    def cluster_name(self) -> str:
-        """
-        The name of the talos kubernetes cluster
-        """
-        return pulumi.get(self, "cluster_name")
-
-    @property
-    @pulumi.getter(name="configPatches")
-    def config_patches(self) -> Optional[Sequence[str]]:
-        """
-        The list of config patches to apply to the generated configuration
-        """
-        return pulumi.get(self, "config_patches")
-
-    @property
-    @pulumi.getter
-    def docs(self) -> Optional[bool]:
-        """
-        Whether to generate documentation for the generated configuration
-        """
-        return pulumi.get(self, "docs")
-
-    @property
-    @pulumi.getter
-    def examples(self) -> Optional[bool]:
-        """
-        Whether to generate examples for the generated configuration
-        """
-        return pulumi.get(self, "examples")
-
-    @property
-    @pulumi.getter
-    def id(self) -> str:
-        """
-        The ID of this resource.
-        """
-        return pulumi.get(self, "id")
-
-    @property
-    @pulumi.getter(name="kubernetesVersion")
-    def kubernetes_version(self) -> Optional[str]:
-        """
-        The version of kubernetes to use
-        """
-        return pulumi.get(self, "kubernetes_version")
-
-    @property
-    @pulumi.getter(name="machineConfiguration")
-    def machine_configuration(self) -> str:
-        """
-        The generated machine configuration
-        """
-        return pulumi.get(self, "machine_configuration")
-
-    @property
-    @pulumi.getter(name="machineSecrets")
-    def machine_secrets(self) -> 'outputs.ConfigurationMachineSecretsResult':
-        """
-        The secrets for the talos cluster
-        """
-        return pulumi.get(self, "machine_secrets")
-
-    @property
-    @pulumi.getter(name="machineType")
-    def machine_type(self) -> str:
-        """
-        The type of machine to generate the configuration for
-        """
-        return pulumi.get(self, "machine_type")
-
-    @property
-    @pulumi.getter(name="talosVersion")
-    def talos_version(self) -> Optional[str]:
-        """
-        The version of talos features to use in generated machine configuration
-        """
-        return pulumi.get(self, "talos_version")
-
-
-class AwaitableConfigurationResult(ConfigurationResult):
-    # pylint: disable=using-constant-test
-    def __await__(self):
-        if False:
-            yield self
-        return ConfigurationResult(
-            cluster_endpoint=self.cluster_endpoint,
-            cluster_name=self.cluster_name,
-            config_patches=self.config_patches,
-            docs=self.docs,
-            examples=self.examples,
-            id=self.id,
-            kubernetes_version=self.kubernetes_version,
-            machine_configuration=self.machine_configuration,
-            machine_secrets=self.machine_secrets,
-            machine_type=self.machine_type,
-            talos_version=self.talos_version)
-
-
-def configuration(cluster_endpoint: Optional[str] = None,
-                  cluster_name: Optional[str] = None,
-                  config_patches: Optional[Sequence[str]] = None,
-                  docs: Optional[bool] = None,
-                  examples: Optional[bool] = None,
-                  kubernetes_version: Optional[str] = None,
-                  machine_secrets: Optional[pulumi.InputType['ConfigurationMachineSecretsArgs']] = None,
-                  machine_type: Optional[str] = None,
-                  talos_version: Optional[str] = None,
-                  opts: Optional[pulumi.InvokeOptions] = None) -> AwaitableConfigurationResult:
-    """
-    Generate a machine configuration for a node type
-
-    > **Note:** It is recommended to set the optional `talos_version` attribute. Otherwise when using a new version of the provider with a new major version of the Talos SDK, new machineconfig features will be enabled by default which could cause unexpected behavior.
-
-    ## Example Usage
-
-    ```python
-    import pulumi
-    import pulumi_talos as talos
-    import pulumiverse_talos as talos
-
-    this_secrets = talos.machine.Secrets("thisSecrets")
-    this_configuration = talos.machine.configuration_output(cluster_name="example-cluster",
-        machine_type="controlplane",
-        cluster_endpoint="https://cluster.local:6443",
-        machine_secrets=this_secrets.machine_secrets)
-    ```
-
-
-    :param str cluster_endpoint: The endpoint of the talos kubernetes cluster
-    :param str cluster_name: The name of the talos kubernetes cluster
-    :param Sequence[str] config_patches: The list of config patches to apply to the generated configuration
-    :param bool docs: Whether to generate documentation for the generated configuration
-    :param bool examples: Whether to generate examples for the generated configuration
-    :param str kubernetes_version: The version of kubernetes to use
-    :param pulumi.InputType['ConfigurationMachineSecretsArgs'] machine_secrets: The secrets for the talos cluster
-    :param str machine_type: The type of machine to generate the configuration for
-    :param str talos_version: The version of talos features to use in generated machine configuration
-    """
-    __args__ = dict()
-    __args__['clusterEndpoint'] = cluster_endpoint
-    __args__['clusterName'] = cluster_name
-    __args__['configPatches'] = config_patches
-    __args__['docs'] = docs
-    __args__['examples'] = examples
-    __args__['kubernetesVersion'] = kubernetes_version
-    __args__['machineSecrets'] = machine_secrets
-    __args__['machineType'] = machine_type
-    __args__['talosVersion'] = talos_version
-    opts = pulumi.InvokeOptions.merge(_utilities.get_invoke_opts_defaults(), opts)
-    __ret__ = pulumi.runtime.invoke('talos:machine/configuration:Configuration', __args__, opts=opts, typ=ConfigurationResult).value
-
-    return AwaitableConfigurationResult(
-        cluster_endpoint=pulumi.get(__ret__, 'cluster_endpoint'),
-        cluster_name=pulumi.get(__ret__, 'cluster_name'),
-        config_patches=pulumi.get(__ret__, 'config_patches'),
-        docs=pulumi.get(__ret__, 'docs'),
-        examples=pulumi.get(__ret__, 'examples'),
-        id=pulumi.get(__ret__, 'id'),
-        kubernetes_version=pulumi.get(__ret__, 'kubernetes_version'),
-        machine_configuration=pulumi.get(__ret__, 'machine_configuration'),
-        machine_secrets=pulumi.get(__ret__, 'machine_secrets'),
-        machine_type=pulumi.get(__ret__, 'machine_type'),
-        talos_version=pulumi.get(__ret__, 'talos_version'))
-
-
-@_utilities.lift_output_func(configuration)
-def configuration_output(cluster_endpoint: Optional[pulumi.Input[str]] = None,
-                         cluster_name: Optional[pulumi.Input[str]] = None,
-                         config_patches: Optional[pulumi.Input[Optional[Sequence[str]]]] = None,
-                         docs: Optional[pulumi.Input[Optional[bool]]] = None,
-                         examples: Optional[pulumi.Input[Optional[bool]]] = None,
-                         kubernetes_version: Optional[pulumi.Input[Optional[str]]] = None,
-                         machine_secrets: Optional[pulumi.Input[pulumi.InputType['ConfigurationMachineSecretsArgs']]] = None,
-                         machine_type: Optional[pulumi.Input[str]] = None,
-                         talos_version: Optional[pulumi.Input[Optional[str]]] = None,
-                         opts: Optional[pulumi.InvokeOptions] = None) -> pulumi.Output[ConfigurationResult]:
-    """
-    Generate a machine configuration for a node type
-
-    > **Note:** It is recommended to set the optional `talos_version` attribute. Otherwise when using a new version of the provider with a new major version of the Talos SDK, new machineconfig features will be enabled by default which could cause unexpected behavior.
-
-    ## Example Usage
-
-    ```python
-    import pulumi
-    import pulumi_talos as talos
-    import pulumiverse_talos as talos
-
-    this_secrets = talos.machine.Secrets("thisSecrets")
-    this_configuration = talos.machine.configuration_output(cluster_name="example-cluster",
-        machine_type="controlplane",
-        cluster_endpoint="https://cluster.local:6443",
-        machine_secrets=this_secrets.machine_secrets)
-    ```
-
-
-    :param str cluster_endpoint: The endpoint of the talos kubernetes cluster
-    :param str cluster_name: The name of the talos kubernetes cluster
-    :param Sequence[str] config_patches: The list of config patches to apply to the generated configuration
-    :param bool docs: Whether to generate documentation for the generated configuration
-    :param bool examples: Whether to generate examples for the generated configuration
-    :param str kubernetes_version: The version of kubernetes to use
-    :param pulumi.InputType['ConfigurationMachineSecretsArgs'] machine_secrets: The secrets for the talos cluster
-    :param str machine_type: The type of machine to generate the configuration for
-    :param str talos_version: The version of talos features to use in generated machine configuration
-    """
-    ...
diff --git a/sdk/python/pulumiverse_talos/machine/disks.py b/sdk/python/pulumiverse_talos/machine/disks.py
deleted file mode 100644
index 7d6bc6f6..00000000
--- a/sdk/python/pulumiverse_talos/machine/disks.py
+++ /dev/null
@@ -1,206 +0,0 @@
-# coding=utf-8
-# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
-# *** Do not edit by hand unless you're certain you know what you are doing! ***
-
-import copy
-import warnings
-import pulumi
-import pulumi.runtime
-from typing import Any, Mapping, Optional, Sequence, Union, overload
-from .. import _utilities
-from . import outputs
-from ._inputs import *
-
-__all__ = [
-    'DisksResult',
-    'AwaitableDisksResult',
-    'disks',
-    'disks_output',
-]
-
-@pulumi.output_type
-class DisksResult:
-    """
-    A collection of values returned by Disks.
-    """
-    def __init__(__self__, client_configuration=None, disks=None, endpoint=None, filters=None, id=None, node=None, timeouts=None):
-        if client_configuration and not isinstance(client_configuration, dict):
-            raise TypeError("Expected argument 'client_configuration' to be a dict")
-        pulumi.set(__self__, "client_configuration", client_configuration)
-        if disks and not isinstance(disks, list):
-            raise TypeError("Expected argument 'disks' to be a list")
-        pulumi.set(__self__, "disks", disks)
-        if endpoint and not isinstance(endpoint, str):
-            raise TypeError("Expected argument 'endpoint' to be a str")
-        pulumi.set(__self__, "endpoint", endpoint)
-        if filters and not isinstance(filters, dict):
-            raise TypeError("Expected argument 'filters' to be a dict")
-        pulumi.set(__self__, "filters", filters)
-        if id and not isinstance(id, str):
-            raise TypeError("Expected argument 'id' to be a str")
-        pulumi.set(__self__, "id", id)
-        if node and not isinstance(node, str):
-            raise TypeError("Expected argument 'node' to be a str")
-        pulumi.set(__self__, "node", node)
-        if timeouts and not isinstance(timeouts, dict):
-            raise TypeError("Expected argument 'timeouts' to be a dict")
-        pulumi.set(__self__, "timeouts", timeouts)
-
-    @property
-    @pulumi.getter(name="clientConfiguration")
-    def client_configuration(self) -> 'outputs.DisksClientConfigurationResult':
-        """
-        The client configuration data
-        """
-        return pulumi.get(self, "client_configuration")
-
-    @property
-    @pulumi.getter
-    def disks(self) -> Sequence['outputs.DisksDiskResult']:
-        """
-        The disks that match the filters
-        """
-        return pulumi.get(self, "disks")
-
-    @property
-    @pulumi.getter
-    def endpoint(self) -> str:
-        """
-        endpoint to use for the talosclient. If not set, the node value will be used
-        """
-        return pulumi.get(self, "endpoint")
-
-    @property
-    @pulumi.getter
-    def filters(self) -> Optional['outputs.DisksFiltersResult']:
-        """
-        Filters to apply to the disks
-        """
-        return pulumi.get(self, "filters")
-
-    @property
-    @pulumi.getter
-    def id(self) -> str:
-        """
-        The generated ID of this resource
-        """
-        return pulumi.get(self, "id")
-
-    @property
-    @pulumi.getter
-    def node(self) -> str:
-        """
-        controlplane node to retrieve the kubeconfig from
-        """
-        return pulumi.get(self, "node")
-
-    @property
-    @pulumi.getter
-    def timeouts(self) -> Optional['outputs.DisksTimeoutsResult']:
-        return pulumi.get(self, "timeouts")
-
-
-class AwaitableDisksResult(DisksResult):
-    # pylint: disable=using-constant-test
-    def __await__(self):
-        if False:
-            yield self
-        return DisksResult(
-            client_configuration=self.client_configuration,
-            disks=self.disks,
-            endpoint=self.endpoint,
-            filters=self.filters,
-            id=self.id,
-            node=self.node,
-            timeouts=self.timeouts)
-
-
-def disks(client_configuration: Optional[pulumi.InputType['DisksClientConfigurationArgs']] = None,
-          endpoint: Optional[str] = None,
-          filters: Optional[pulumi.InputType['DisksFiltersArgs']] = None,
-          node: Optional[str] = None,
-          timeouts: Optional[pulumi.InputType['DisksTimeoutsArgs']] = None,
-          opts: Optional[pulumi.InvokeOptions] = None) -> AwaitableDisksResult:
-    """
-    Generate a machine configuration for a node type
-
-    > **Note:** Since Talos natively supports `.machine.install.diskSelector`, the `machine__disks` data source maybe just used to query disk information that could be used elsewhere. It's recommended to use `machine.install.diskSelector` in Talos machine configuration.
-
-    ## Example Usage
-
-    ```python
-    import pulumi
-    import pulumi_talos as talos
-    import pulumiverse_talos as talos
-
-    this_secrets = talos.machine.Secrets("thisSecrets")
-    this_disks = talos.machine.disks_output(client_configuration=this_secrets.client_configuration,
-        node="10.5.0.2",
-        filters=talos.machine.DisksFiltersArgs(
-            size="> 100GB",
-            type="nvme",
-        ))
-    pulumi.export("nvmeDisks", this_disks.apply(lambda this_disks: [__item.name for __item in this_disks.disks]))
-    ```
-
-
-    :param pulumi.InputType['DisksClientConfigurationArgs'] client_configuration: The client configuration data
-    :param str endpoint: endpoint to use for the talosclient. If not set, the node value will be used
-    :param pulumi.InputType['DisksFiltersArgs'] filters: Filters to apply to the disks
-    :param str node: controlplane node to retrieve the kubeconfig from
-    """
-    __args__ = dict()
-    __args__['clientConfiguration'] = client_configuration
-    __args__['endpoint'] = endpoint
-    __args__['filters'] = filters
-    __args__['node'] = node
-    __args__['timeouts'] = timeouts
-    opts = pulumi.InvokeOptions.merge(_utilities.get_invoke_opts_defaults(), opts)
-    __ret__ = pulumi.runtime.invoke('talos:machine/disks:Disks', __args__, opts=opts, typ=DisksResult).value
-
-    return AwaitableDisksResult(
-        client_configuration=pulumi.get(__ret__, 'client_configuration'),
-        disks=pulumi.get(__ret__, 'disks'),
-        endpoint=pulumi.get(__ret__, 'endpoint'),
-        filters=pulumi.get(__ret__, 'filters'),
-        id=pulumi.get(__ret__, 'id'),
-        node=pulumi.get(__ret__, 'node'),
-        timeouts=pulumi.get(__ret__, 'timeouts'))
-
-
-@_utilities.lift_output_func(disks)
-def disks_output(client_configuration: Optional[pulumi.Input[pulumi.InputType['DisksClientConfigurationArgs']]] = None,
-                 endpoint: Optional[pulumi.Input[Optional[str]]] = None,
-                 filters: Optional[pulumi.Input[Optional[pulumi.InputType['DisksFiltersArgs']]]] = None,
-                 node: Optional[pulumi.Input[str]] = None,
-                 timeouts: Optional[pulumi.Input[Optional[pulumi.InputType['DisksTimeoutsArgs']]]] = None,
-                 opts: Optional[pulumi.InvokeOptions] = None) -> pulumi.Output[DisksResult]:
-    """
-    Generate a machine configuration for a node type
-
-    > **Note:** Since Talos natively supports `.machine.install.diskSelector`, the `machine__disks` data source maybe just used to query disk information that could be used elsewhere. It's recommended to use `machine.install.diskSelector` in Talos machine configuration.
-
-    ## Example Usage
-
-    ```python
-    import pulumi
-    import pulumi_talos as talos
-    import pulumiverse_talos as talos
-
-    this_secrets = talos.machine.Secrets("thisSecrets")
-    this_disks = talos.machine.disks_output(client_configuration=this_secrets.client_configuration,
-        node="10.5.0.2",
-        filters=talos.machine.DisksFiltersArgs(
-            size="> 100GB",
-            type="nvme",
-        ))
-    pulumi.export("nvmeDisks", this_disks.apply(lambda this_disks: [__item.name for __item in this_disks.disks]))
-    ```
-
-
-    :param pulumi.InputType['DisksClientConfigurationArgs'] client_configuration: The client configuration data
-    :param str endpoint: endpoint to use for the talosclient. If not set, the node value will be used
-    :param pulumi.InputType['DisksFiltersArgs'] filters: Filters to apply to the disks
-    :param str node: controlplane node to retrieve the kubeconfig from
-    """
-    ...
diff --git a/sdk/python/pulumiverse_talos/machine/get_configuration.py b/sdk/python/pulumiverse_talos/machine/get_configuration.py
index a6a7d382..f95bb5af 100644
--- a/sdk/python/pulumiverse_talos/machine/get_configuration.py
+++ b/sdk/python/pulumiverse_talos/machine/get_configuration.py
@@ -188,8 +188,8 @@ def get_configuration(cluster_endpoint: Optional[str] = None,
     import pulumi_talos as talos
     import pulumiverse_talos as talos
 
-    this_secrets = talos.machine.Secrets("thisSecrets")
-    this_configuration = talos.machine.get_configuration_output(cluster_name="example-cluster",
+    this_secrets = talos.machine.Secrets("this")
+    this = talos.machine.get_configuration_output(cluster_name="example-cluster",
         machine_type="controlplane",
         cluster_endpoint="https://cluster.local:6443",
         machine_secrets=this_secrets.machine_secrets)
@@ -256,8 +256,8 @@ def get_configuration_output(cluster_endpoint: Optional[pulumi.Input[str]] = Non
     import pulumi_talos as talos
     import pulumiverse_talos as talos
 
-    this_secrets = talos.machine.Secrets("thisSecrets")
-    this_configuration = talos.machine.get_configuration_output(cluster_name="example-cluster",
+    this_secrets = talos.machine.Secrets("this")
+    this = talos.machine.get_configuration_output(cluster_name="example-cluster",
         machine_type="controlplane",
         cluster_endpoint="https://cluster.local:6443",
         machine_secrets=this_secrets.machine_secrets)
diff --git a/sdk/python/pulumiverse_talos/machine/get_disks.py b/sdk/python/pulumiverse_talos/machine/get_disks.py
index 8cd44b14..c4683bc4 100644
--- a/sdk/python/pulumiverse_talos/machine/get_disks.py
+++ b/sdk/python/pulumiverse_talos/machine/get_disks.py
@@ -133,14 +133,14 @@ def get_disks(client_configuration: Optional[Union['GetDisksClientConfigurationA
     import pulumi_talos as talos
     import pulumiverse_talos as talos
 
-    this_secrets = talos.machine.Secrets("thisSecrets")
-    this_disks = talos.machine.get_disks_output(client_configuration=this_secrets.client_configuration,
+    this_secrets = talos.machine.Secrets("this")
+    this = talos.machine.get_disks_output(client_configuration=this_secrets.client_configuration,
         node="10.5.0.2",
         filters={
             "size": "> 100GB",
             "type": "nvme",
         })
-    pulumi.export("nvmeDisks", this_disks.apply(lambda this_disks: [__item.name for __item in this_disks.disks]))
+    pulumi.export("nvmeDisks", this.apply(lambda this: [__item.name for __item in this.disks]))
     ```
 
 
@@ -187,14 +187,14 @@ def get_disks_output(client_configuration: Optional[pulumi.Input[Union['GetDisks
     import pulumi_talos as talos
     import pulumiverse_talos as talos
 
-    this_secrets = talos.machine.Secrets("thisSecrets")
-    this_disks = talos.machine.get_disks_output(client_configuration=this_secrets.client_configuration,
+    this_secrets = talos.machine.Secrets("this")
+    this = talos.machine.get_disks_output(client_configuration=this_secrets.client_configuration,
         node="10.5.0.2",
         filters={
             "size": "> 100GB",
             "type": "nvme",
         })
-    pulumi.export("nvmeDisks", this_disks.apply(lambda this_disks: [__item.name for __item in this_disks.disks]))
+    pulumi.export("nvmeDisks", this.apply(lambda this: [__item.name for __item in this.disks]))
     ```
 
 
diff --git a/sdk/python/pulumiverse_talos/machine/secrets.py b/sdk/python/pulumiverse_talos/machine/secrets.py
index 921d1445..eb94c26d 100644
--- a/sdk/python/pulumiverse_talos/machine/secrets.py
+++ b/sdk/python/pulumiverse_talos/machine/secrets.py
@@ -109,7 +109,7 @@ def __init__(__self__,
         import pulumi
         import pulumiverse_talos as talos
 
-        machine_secrets = talos.machine.Secrets("machineSecrets")
+        machine_secrets = talos.machine.Secrets("machine_secrets")
         ```
 
         ## Import
@@ -141,7 +141,7 @@ def __init__(__self__,
         import pulumi
         import pulumiverse_talos as talos
 
-        machine_secrets = talos.machine.Secrets("machineSecrets")
+        machine_secrets = talos.machine.Secrets("machine_secrets")
         ```
 
         ## Import
diff --git a/sdk/python/pyproject.toml b/sdk/python/pyproject.toml
new file mode 100644
index 00000000..28f9de3e
--- /dev/null
+++ b/sdk/python/pyproject.toml
@@ -0,0 +1,22 @@
+[project]
+  name = "pulumiverse_talos"
+  description = "A Pulumi package for creating and managing Talos Linux machines and clusters."
+  dependencies = ["parver>=0.2.1", "pulumi>=3.0.0,<4.0.0", "semver>=2.8.1"]
+  keywords = ["pulumi", "talos", "category/infrastructure"]
+  readme = "README.md"
+  requires-python = ">=3.8"
+  version = "0.0.0"
+  [project.license]
+    text = "MPL-2.0"
+  [project.urls]
+    Homepage = "https://talos.dev"
+    Repository = "https://github.com/pulumiverse/pulumi-talos"
+
+[build-system]
+  requires = ["setuptools>=61.0"]
+  build-backend = "setuptools.build_meta"
+
+[tool]
+  [tool.setuptools]
+    [tool.setuptools.package-data]
+      pulumiverse_talos = ["py.typed", "pulumi-plugin.json"]
diff --git a/sdk/python/setup.py b/sdk/python/setup.py
deleted file mode 100644
index 9cc70f79..00000000
--- a/sdk/python/setup.py
+++ /dev/null
@@ -1,44 +0,0 @@
-# coding=utf-8
-# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
-# *** Do not edit by hand unless you're certain you know what you are doing! ***
-
-import errno
-from setuptools import setup, find_packages
-from setuptools.command.install import install
-from subprocess import check_call
-
-
-VERSION = "0.0.0"
-def readme():
-    try:
-        with open('README.md', encoding='utf-8') as f:
-            return f.read()
-    except FileNotFoundError:
-        return "talos Pulumi Package - Development Version"
-
-
-setup(name='pulumiverse_talos',
-      python_requires='>=3.8',
-      version=VERSION,
-      description="A Pulumi package for creating and managing Talos Linux machines and clusters.",
-      long_description=readme(),
-      long_description_content_type='text/markdown',
-      keywords='pulumi talos category/infrastructure',
-      url='https://talos.dev',
-      project_urls={
-          'Repository': 'https://github.com/pulumiverse/pulumi-talos'
-      },
-      license='MPL-2.0',
-      packages=find_packages(),
-      package_data={
-          'pulumiverse_talos': [
-              'py.typed',
-              'pulumi-plugin.json',
-          ]
-      },
-      install_requires=[
-          'parver>=0.2.1',
-          'pulumi>=3.0.0,<4.0.0',
-          'semver>=2.8.1'
-      ],
-      zip_safe=False)
diff --git a/upstream.sh b/upstream.sh
new file mode 100755
index 00000000..f5609ac6
--- /dev/null
+++ b/upstream.sh
@@ -0,0 +1,375 @@
+#!/usr/bin/env bash
+# WARNING: This file is autogenerated - changes will be overwritten if not made via https://github.com/pulumi/ci-mgmt
+
+set -e
+
+original_exec="$0"
+original_cmd="$1"
+
+usage() {
+  cat <<EOF
+NAME
+  upstream.sh - Manages applying patches to the upstream submodule.
+
+SYNOPSIS
+  ${original_exec} <init|checkout|rebase|check_in|help> [options]
+
+COMMANDS
+  init [-f]             Initialize the upstream submodule and applies the
+                        patches to the working directory.
+  checkout [-f]         Create a branch in the upstream repository with the
+                        patches applied as commits.
+  rebase [-o] [-i]      Rebase the checked out patches.
+  check_in              Write checkedout commits back to patches, add upstream
+                        and patches changes to the git staging area and exit
+                        checkout mode.
+  help                  Print this help message, plus examples.
+
+OPTIONS
+  -f   Force the command to run even if the upstream submodule is modified
+  -o   The new base commit to rebase the patches on top of
+  -i   Run the rebase command interactively
+  -h   Print this help message, plus examples
+EOF
+}
+
+extended_docs() {
+  cat <<EOF
+
+DESCRIPTION
+  We want to maintain changes to the upstream repository in a way that is easy
+  to manage and track. Rather than creating a fork of the upstream repository,
+  we maintain a set of patches (in the 'patches' directory) that we can apply
+  directly to the upstream code in the 'upstream' submodule. Our patches are 
+  never pushed to the remote upstream repository.
+
+EXAMPLES
+  Discard all changes in upstream and reapply patches to the working directory:
+    ${original_exec} init -f
+
+  Moving the patches to a new base commit:
+    ${original_exec} checkout
+    ${original_exec} rebase -o <new_base_commit>
+    ${original_exec} check_in
+
+  Interactively edit the patches:
+    ${original_exec} checkout
+    ${original_exec} rebase -i
+    ${original_exec} check_in
+
+  Add a new patch:
+    ${original_exec} checkout
+    # Make changes to the upstream repository
+    git commit -am "Add new feature"
+    ${original_exec} check_in
+EOF
+}
+
+assert_upstream_exists() {
+  if [[ ! -d upstream ]]; then
+    echo "No 'upstream' directory detected. Aborting."
+    exit 1
+  fi
+}
+
+assert_not_checked_out() {
+  current_branch=$(cd upstream && git --no-pager rev-parse --abbrev-ref HEAD)
+  if [[ "${current_branch}" == "pulumi/patch-checkout" ]]; then
+    cat <<EOF
+Error: 'upstream' submodule checked out on the 'pulumi/patch-checkout' branch.
+This was likely caused by running a 'checkout' command but not running
+'check_in' afterwards.
+
+To turn the commits in the 'pulumi/patch-checkout' branch back into patches, run:
+  ${original_exec} check_in
+
+To disgard changes in the 'pulumi/patch-checkout' branch, use the 'force' flag (-f):
+  ${original_exec} ${original_cmd} -f
+
+EOF
+    exit 1
+  fi
+
+}
+
+assert_is_checked_out() {
+  current_branch=$(cd upstream && git --no-pager rev-parse --abbrev-ref HEAD)
+  if [[ "${current_branch}" != "pulumi/patch-checkout" ]]; then
+    echo "Expected upstream to be checked out on the 'pulumi/patch-checkout' branch, but ${current_branch} is checked out."
+    exit 1
+  fi
+}
+
+assert_no_rebase_in_progress() {
+    # Use git to resolve the possible location of files indicating a rebase might be in progress.
+  rebase_merge_dir=$(cd upstream && git rev-parse --git-path rebase-merge)
+  rebase_apply_dir=$(cd upstream && git rev-parse --git-path rebase-apply)
+
+  if [[ -d "${rebase_merge_dir}" ]] || [[ -d "${rebase_apply_dir}" ]]; then
+    echo "rebase still in progress in './upstream'. Please resolve the rebase in"
+    exit 1
+  fi
+}
+
+err_failed_to_apply() {
+  cat <<EOF
+
+Failed to apply $1.
+
+Hint: to avoid conflicts when updating the upstream submodule, use the
+following commands:
+
+1. '${original_exec} checkout' to create a branch with the patches applied as commits
+2. '${original_exec} rebase -o <new_base_commit>' to rebase the patches on top of the
+    new upstream commit. Resolve any conflicts and continue the rebase to completion.
+3. '${original_exec} check_in' to create an updated set of patches from the commits
+
+Reset the upstream submodule to the previous known good upstream commit before
+trying again. This can be done with:
+
+    (cd upstream && git reset --hard <last_known_good_commit>)
+    git add upstream
+
+EOF
+  exit 1
+}
+
+apply_patches() {
+  # Iterating over the patches folder in sorted order,
+  # apply the patch using a 3-way merge strategy. This mirrors the default behavior of 'git merge'
+  cd upstream
+  for patch in ../patches/*.patch; do
+    if ! git apply --3way "${patch}" --allow-empty; then
+      err_failed_to_apply "$(basename "${patch}")"
+    fi
+  done
+}
+
+clean_rebases() {
+  # Clean up any previous in-progress rebases.
+  cd upstream
+  rebase_merge_dir=$(git rev-parse --git-path rebase-merge)
+  rebase_apply_dir=$(git rev-parse --git-path rebase-apply)
+  rm -rf "${rebase_merge_dir}"
+  rm -rf "${rebase_apply_dir}"
+  cd ..
+}
+
+clean_branches() {
+  cd upstream
+  if git show-ref --verify --quiet refs/heads/pulumi/patch-checkout; then
+    git branch -D pulumi/patch-checkout
+  fi
+  if git show-ref --verify --quiet refs/heads/pulumi/checkout-base; then
+    git branch -D pulumi/checkout-base
+  fi
+  if git show-ref --verify --quiet refs/heads/pulumi/original-base; then
+    git branch -D pulumi/original-base
+  fi
+  cd ..
+}
+
+init() {
+  # Parse additional flags
+  while getopts "f" flag; do
+    case "${flag}" in
+       f) force="true";;
+       *) echo "Unexpected option ${flag}"; exit 1;;
+    esac
+  done
+
+  assert_upstream_exists
+
+  if [[ "${force}" != "true" ]]; then
+    assert_not_checked_out
+    assert_no_rebase_in_progress
+  fi
+
+  git submodule update --force --init
+  cd upstream && git clean -fxd && cd ..
+
+  if [[ "${force}" == "true" ]]; then
+    clean_rebases
+    clean_branches
+  fi
+  apply_patches
+}
+
+checkout() {
+  # Parse additional flags
+  while getopts "f" flag; do
+    case "${flag}" in
+       f) force="true";;
+       *) echo "Unexpected option ${flag}"; exit 1;;
+    esac
+  done
+
+  assert_upstream_exists
+
+  if [[ "${force}" != "true" ]]; then
+    assert_not_checked_out
+    assert_no_rebase_in_progress
+  fi
+
+  git submodule update --force --init
+  if [[ "${force}" == "true" ]]; then
+    clean_rebases
+    clean_branches
+  fi
+
+  cd upstream
+  git fetch --all
+
+  # Set the 'pulumi/checkout-base' branch to the current commit of the upstream repository
+  # This is used to track the base commit of the patches
+  # If rebasing, then this must be moved to the new base commit.
+  git branch -f pulumi/checkout-base
+  # Create a new branch 'pulumi/patch-checkout' which will contain the commits for each patch
+  git checkout -B pulumi/patch-checkout
+
+  for patch in ../patches/*.patch; do
+    if ! git am --3way "${patch}"; then
+      err_failed_to_apply "$(basename "${patch}")"
+    fi
+  done
+
+    cat <<EOF
+
+The patches have been checked out as commits in the './upstream' repository.
+The 'pulumi/patch-checkout' branch is pointing to the last patch.
+The 'pulumi/checkout-base' branch is pointing to the base commit of the patches.
+
+To interactively edit the commits:
+  ${original_exec} rebase -i
+
+To change the base of the patches:
+  ${original_exec} rebase -o <new_base_commit>
+
+Once you have finished editing the commits, run
+  ${original_exec} check_in
+
+EOF
+}
+
+rebase() {
+  # Parse additional flags
+  onto="pulumi/checkout-base"
+  interactive="false"
+  while getopts "io:" flag; do
+    case "${flag}" in
+       i) interactive="true";;
+       o) onto="${OPTARG}";;
+       *) echo "Unexpected option ${flag}"; exit 1;;
+    esac
+  done
+
+  assert_is_checked_out
+
+  cd upstream
+  # Fetch the latest changes from the upstream repository
+  git fetch --all
+  # Set the "pulumi/original-base" branch to the current base commit of the patches
+  git branch -f pulumi/original-base pulumi/checkout-base
+  # Set the "pulumi/patch-checkout" branch to track the "pulumi/original-base" branch
+  git branch --set-upstream-to=pulumi/original-base pulumi/patch-checkout
+  # Set the "pulumi/checkout-base" branch to the new base commit ready for formatting the patches after
+  git branch -f pulumi/checkout-base "${onto}"
+  # Rebase the 'pulumi/patch-checkout' branch on top of the new base commit
+  interactive_flag=""
+  if [[ "${interactive}" == "true" ]]; then
+    interactive_flag="--interactive"
+  fi
+  if ! git rebase --onto "${onto}" ${interactive_flag}; then
+    echo "Rebase failed. Please resolve the conflicts and run 'git rebase --continue' in the upstream directory."
+    exit 1
+  fi
+  cd ..
+}
+
+export_patches() {
+  # Remove all existing patches before creating the new ones in case they've been renamed or removed.
+  rm -f patches/*.patch
+  
+  # Extract patches from the commits in the 'pulumi/patch-checkout' branch into the 'patches' directory.
+  # Use the 'pulumi/checkout-base' branch to determine the base commit of the patches.
+  (cd upstream && git format-patch pulumi/checkout-base -o ../patches --zero-commit --no-signature --no-stat --no-numbered)
+}
+
+format_patches() {
+  assert_upstream_exists
+  assert_is_checked_out
+  assert_no_rebase_in_progress
+
+  export_patches
+  cat <<EOF
+Patches have been created in the 'patches' directory. If you've made changes to
+the base, ensure you add 'upstream' to the git stage before running 'init -f'
+to exit the checkout mode.
+EOF
+}
+
+check_in() {
+  assert_upstream_exists
+  assert_is_checked_out
+  assert_no_rebase_in_progress
+
+  export_patches
+  # Check out the new base of the patches
+  (cd upstream && git checkout pulumi/checkout-base)
+
+  # Add the patches and upstream changes to the git staging area
+  git add patches upstream
+  # Exit the checkout mode and re-initialize the upstream submodule
+  git submodule update --force --init
+  apply_patches
+  cat <<EOF
+Changes to patches and upstream have been staged, exited checkout mode and
+re-initializing using updated patches and updated upstream base.
+EOF
+}
+
+if [[ -z ${original_cmd} ]]; then
+  echo "Error: command is required."
+  echo
+  usage
+  extended_docs
+  exit 1
+fi
+# Check for help flag and short-circuit to print usage.
+for arg in "$@"; do
+  case ${arg} in
+    "help"|"-h"|"--help")
+      usage
+      extended_docs
+      exit 0
+      ;;
+    *)
+      ;;
+  esac
+done
+
+# Remove the command argument from the list of arguments to pass to the command.
+shift
+case ${original_cmd} in
+  init)
+    init "$@"
+    ;;
+  checkout|check_out)
+    checkout "$@"
+    ;;
+  rebase)
+    rebase "$@"
+    ;;
+  format_patches)
+    format_patches "$@"
+    ;;
+  check_in|checkin)
+    check_in "$@"
+    ;;
+  *)
+    echo "Error: unknown command \"${original_cmd}\"."
+    echo
+    usage
+    exit 1
+    ;;
+esac